Skip to content
Threat Feed
Subscribe

Product

Webmail (< 1.7.5)

1 brief RSS
high advisory

IMAP Command Injection in Roundcube Webmail

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 are vulnerable to IMAP command injection via CRLF sequences in the _uid parameter, allowing authenticated remote attackers to execute arbitrary IMAP commands.

PoC Webmail +1 web-vulnerability imap injection
1r 1t 2c updated