CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

EUVD-2026-107702

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...

CVE-2026-114725

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a mail header injection vulnerability. The root cause is that the rcmail_sendmail function only stripped newline characters from the Subject and Organization headers, leaving other header values taken from request p...

EUVD-2026-107701

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

CVE-2026-114724

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an object injection primitive within the rcube_session::unserialize() function. The root cause is that session keys prefixed with "!" were treated as having no value, causing the reconstructed serialized string to d...

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

CVE-2026-114724

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize. A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th...

EUVD-2026-107700

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...

CVE-2026-114723

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a resource limit bypass during thumbnail generation. When the rcube_image component falls back to GD , the available-memory check is only applied on Windows. On other platforms, a crafted image with large dimensions...

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...