---
cve: "CVE-2026-114717"
severity: "MEDIUM"
cvss: 4.0
epss: ""
vendor: "Roundcube"
kev: false
exploited: false
published: "2026-10-22 01:21:14"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-22T23:11:49+02:00"
---

# CVE-2026-114717

> 4.0 MEDIUM · 🧪 PoC

## Beschreibung

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2026-10-22 01:21:14
- CNA-CVSS: **4.0** (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N`)

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-99** — Improper Control of Resource Identifiers ('Resource Injection')
  The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

## Angriffsmuster (CAPEC)

- [CAPEC-10 — Buffer Overflow via Environment Variables](https://capec.mitre.org/data/definitions/10.html) _(Severity: High)_
- [CAPEC-75 — Manipulating Writeable Configuration Files](https://capec.mitre.org/data/definitions/75.html) _(Severity: Very High)_
- [CAPEC-240 — Resource Injection](https://capec.mitre.org/data/definitions/240.html) _(Severity: High)_

## Patch verfügbar (OSV)

- 4c3291ce9df9e1d3b45330d0854d65cd8efbeee9 (Commit)
- 26d1b077f0c910a16c44c1862fe26e15f0bb3685 (Commit)

## Referenzen

- <https://bugs.debian.org/1151279>
- <https://github.com/roundcube/roundcubemail/commit/4c3291ce9df9e1d3b45330d0854d65cd8efbeee9>
- <https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5>
- <https://github.com/roundcube/roundcubemail/releases/tag/1.7.5>
- <https://github.com/roundcube/roundcubemail/releases/tag/1.6.20>
- <https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-114717/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_