CVE-2026-114716 Roundcube CVE debrief

Who should care

Defenders responsible for Roundcube Webmail instances, particularly those using versions before 1.6.20 and 1.7.5, should assess exposure and apply patches or updates. This includes operators managing affected deployments, vulnerability management teams, and security teams responsible for monitoring and mitigating potential threats. They should verify validation of media types in inline image data URIs and monitor outgoing messages for potential header

Why it matters

CVE-2026-114716 is a high-severity vulnerability affecting Roundcube Webmail, allowing remote authenticated attackers to inject arbitrary MIME part headers into outgoing messages. Defenders should prioritize assessing exposure and applying patches for versions before 1.6.20 and 1.7.5.

• Potential for header injection in outgoing messages
• Possible exploitation by remote authenticated attackers
• Need for validation of media types in inline image data URIs
• Priority on patching or updating affected Roundcube Webmail versions

Technical summary

The vulnerability is caused by the lack of validation of the media type in the rcmail_sendmail::extract_inline_images() function, allowing remote authenticated attackers to inject arbitrary MIME part headers into outgoing messages. This issue affects Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The vulnerability can be exploited by placing CRLF sequences in the media type of an inline image data URI. Upstream fixed this in the commit 'Fix mail header injection via media type in an inline image data URI', which validates the media type with rcube_mime::is_mimetype_valid(). Defenders should prioritize assessing exposure and applying patches for Roundcube Webmail versions before 1.6.20 and 1.7.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Roundcube Webmail versions before 1.6.20 and 1.7.5.

Recommended defensive actions

• Assess exposure of Roundcube Webmail instances to this vulnerability
• Apply patches or updates to affected versions (before 1.6.20 and 1.7.5)
• Verify validation of media types in inline image data URIs
• Monitor outgoing messages for potential header injection
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability details are based on the CVE Program record and the NVD vulnerability detail page. The issue is caused by the lack of validation of the media type in the rcmail_sendmail::extract_inline_images() function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.