CVE-2026-113386
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit t
CVSS
7.1
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-93
Not enough EPSS history yet.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
- bugs.debian.orghttps://bugs.debian.org/1151279
- github.comhttps://github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a
- github.comhttps://github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049
- github.comhttps://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
- github.comhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- github.comhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- roundcube.nethttps://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1134036.5 MED—
——0ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.8hCVE-2026-918313.8 LOW4.9%
——1The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.19hCVE-2026-1112285.5 MED56.2%
——17Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.19hCVE-2026-1112275.5 MED56.2%
——17Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.19hCVE-2026-1112226.6 MED61.5%
——18Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.5dCVE-2026-1112216.6 MED60.7%
——18Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.5d