CVE-2026-114720

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an IMAP command injection vulnerability. A remote authenticated attacker can exploit this by injecting CRLF sequences into the _flag parameter of the mail/mark action , allowing for the execution of arbitrary IMAP c...