CVE-2026-113386highCWE-93

CVE-2026-113386: high-severity vulnerability in Roundcube Webmail

Published 20 Oct 2026 · Updated 22 Oct 2026

Follow this CVE + Monitor Webmail + Monitor roundcube

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 1.0%

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Affected products

Roundcube · Webmail

Related CVEs — Roundcube Webmail

In the same product, most dangerous first.

CVE-2025-49113CRITICALCVE-2025-49113EPSS 99.5%KEV CVE-2025-68461HIGHCVE-2025-68461EPSS 27.4%KEV CVE-2026-48842HIGHCVE-2026-48842EPSS 1.7%CVE-2026-75002HIGHCVE-2026-75002EPSS 1.4%CVE-2026-114720HIGHCVE-2026-114720EPSS 0.8%CVE-2026-74997HIGHCVE-2026-74997EPSS 0.8%

References

https://bugs.debian.org/1151279 https://github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a https://github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049 https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447 https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5