CVE-2026-113386: Roundcube Webmail IMAP RCE Vulnerability

CVE-2026-113386 Overview

CVE-2026-113386 is an IMAP command injection vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.x before 1.7.5. The flaw resides in the mail/headers and mail/viewsource actions, which fail to sanitize carriage return and line feed (CRLF) sequences in the _uid request parameter. A remote authenticated attacker can inject arbitrary IMAP commands into the backend session by crafting a malicious _uid value. The weakness is tracked as CRLF Injection [CWE-93].

Critical Impact
An authenticated attacker can execute arbitrary IMAP commands in the context of the victim's mailbox session, enabling mailbox manipulation, message disclosure, and integrity compromise of stored mail.

Affected Products

Roundcube Webmail versions prior to 1.6.20
Roundcube Webmail 1.7.x versions prior to 1.7.5
Downstream distributions packaging vulnerable Roundcube releases (e.g., Debian — see bug #1151279)

Discovery Timeline

2026-10-19 - Roundcube publishes security update announcement for 1.6.20 and 1.7.5
2026-10-20 - CVE-2026-113386 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113386

Vulnerability Analysis

Roundcube Webmail accepts the _uid HTTP parameter through rcube_utils::get_input_string() in both program/actions/mail/headers.php and program/actions/mail/viewsource.php. The retrieved value is passed into downstream IMAP operations without checking for CRLF characters. Because the IMAP protocol delimits commands using \r\n, an attacker who embeds these bytes in _uid can terminate the current command and append arbitrary IMAP verbs to the stream. This grants the attacker direct control over commands issued to the IMAP backend under the victim's authenticated session.

Root Cause

The root cause is missing input validation on user-controlled data that is interpolated into a line-oriented protocol. Roundcube trusted the _uid parameter to be a numeric message identifier and did not reject CRLF sequences before building IMAP requests, satisfying the conditions for [CWE-93] CRLF Injection.

Attack Vector

Exploitation requires an authenticated session to the Roundcube Webmail interface. The attacker issues a crafted HTTP GET or POST request to the mail/headers or mail/viewsource action with a _uid value containing %0d%0a separators followed by additional IMAP commands. The injected commands execute inline with the user's mailbox connection, allowing operations such as SELECT, FETCH, STORE, or DELETE across arbitrary folders accessible to that account.

php

// Patch: program/actions/mail/headers.php
        $uid = rcube_utils::get_input_string('_uid', rcube_utils::INPUT_GP);
        $inline = $rcmail->output instanceof rcmail_output_html;

-        if (!$uid) {
+        if (!$uid || preg_match('/[\r\n]/', $uid)) {
+            rcube::raise_error("Message UID {$uid} not found", true, true);
            exit;
        }

// Patch: program/actions/mail/viewsource.php
        ob_end_clean();

        // similar code as in program/steps/mail/get.inc
-        if ($uid = rcube_utils::get_input_string('_uid', rcube_utils::INPUT_GET)) {
+        $uid = rcube_utils::get_input_string('_uid', rcube_utils::INPUT_GET);
+        if ($uid && !preg_match('/[\r\n]/', $uid)) {
            if ($pos = strpos($uid, '.')) {
                $message = new rcube_message($uid);
                $headers = $message->headers;

Source: Roundcube Commit 004adaa. The fix rejects any _uid value containing \r or \n before the parameter reaches IMAP command construction.

Detection Methods for CVE-2026-113386

Indicators of Compromise

HTTP requests to ?_task=mail&_action=headers or ?_task=mail&_action=viewsource containing URL-encoded CRLF (%0d%0a, %0a, or %0d) within the _uid parameter.
Web server access logs showing unusually long _uid values or non-numeric characters where a message UID is expected.
IMAP server logs recording unexpected commands (for example, SELECT, STORE, or DELETE) immediately following a FETCH tied to a Roundcube session.

Detection Strategies

Deploy a web application firewall rule that blocks or alerts on CRLF characters in the _uid query or POST parameter for Roundcube endpoints.
Correlate Roundcube session identifiers in web access logs with IMAP backend command sequences to identify injected verbs.
Hunt for anomalous mailbox state changes (bulk deletions, flag changes, folder moves) initiated from webmail sessions.

Monitoring Recommendations

Enable verbose IMAP protocol logging on backend mail servers (Dovecot, Cyrus) for the duration of patch rollout.
Alert on any Roundcube process emitting the "Message UID {$uid} not found" error introduced by the patch, which signals attempted exploitation after upgrade.
Review authentication logs for compromised accounts that could be used to meet the authenticated-attacker prerequisite.

How to Mitigate CVE-2026-113386

Immediate Actions Required

Upgrade Roundcube Webmail to version 1.6.20 or version 1.7.5.
Apply distribution-provided updates where applicable, such as the Debian package tracked in Debian Bug #1151279.
Rotate credentials for any webmail accounts suspected of exposure and audit mailbox contents for unauthorized changes.

Patch Information

The Roundcube project released fixes in commits 004adaa, bf5bc02, and f62879d. The patches add a preg_match('/[\r\n]/', $uid) check in program/actions/mail/headers.php and program/actions/mail/viewsource.php to reject any _uid value containing CRLF bytes. See the official Roundcube Security Updates Announcement for release details.

Workarounds

If immediate patching is not possible, place a reverse proxy or WAF rule in front of Roundcube that rejects requests where the _uid parameter contains characters outside the expected numeric and . set.
Restrict access to the Roundcube interface to authenticated VPN users while updates are being staged.
Monitor and rate-limit requests to the mail/headers and mail/viewsource actions.

bash

# Example nginx rule to block CRLF in _uid parameter for Roundcube
if ($args ~* "(^|&)_uid=[^&]*(%0d|%0a|\r|\n)") {
    return 400;
}