CVE-2026-113386highCWE-93

CVE-2026-113386: falha de alta gravidade em Roundcube Webmail

Publicada em 20 out 2026 · Atualizada em 22 out 2026

Seguir esta CVE + Monitorar Webmail + Monitorar roundcube

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 1.0%

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Produtos afetados

Roundcube · Webmail

CVEs relacionadas — Roundcube Webmail

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49113CRITICALCVE-2025-49113EPSS 99.5%KEV CVE-2025-68461HIGHCVE-2025-68461EPSS 27.4%KEV CVE-2026-48842HIGHCVE-2026-48842EPSS 1.7%CVE-2026-75002HIGHCVE-2026-75002EPSS 1.4%CVE-2026-114720HIGHCVE-2026-114720EPSS 0.8%CVE-2026-74997HIGHCVE-2026-74997EPSS 0.8%

Referências

https://bugs.debian.org/1151279 https://github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a https://github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049 https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447 https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5