CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.

What is CVE-2026-114720?

CVE-2026-114720 is a high-severity vulnerability in Roundcube Webmail, published on 22 Oct 2026.

Official description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.

Weakness: CWE-93

Which versions are affected by CVE-2026-114720?

How do I fix CVE-2026-114720?

Upgrade to a fixed version.

Is CVE-2026-114720 being exploited?

There is no known exploitation of CVE-2026-114720 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-114720, GHSA-3p38-q93v-93w8, UBUNTU-CVE-2026-114720.