Loading vulnerability…
MIME Header Injection in Roundcube Webmail Inline Image Processing
CVE-2026-114716 is a mail header injection vulnerability affecting Roundcube Webmail before 1.6.20 and the 1.7.x branch before 1.7.5. The rcmail_sendmail::extract_inline_images() function uses the media type from an inline image data URI without validating it. A remote authenticated attacker can embed carriage-return and line-feed sequences in that media type to inject arbitrary MIME part headers into outgoing messages.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises outgoing message integrity by allowing attacker-controlled MIME part headers to be inserted during inline image processing. These headers can alter how message parts are interpreted by downstream mail software. The vulnerability's CVSS assessment indicates high integrity impact, low confidentiality impact, and no availability impact; specific confidentiality exploitation scenarios are not established.
Patch, then assume compromise.
Upgrade to Roundcube Webmail 1.6.20 or later in the 1.6.x branch, or 1.7.5 or later in the 1.7.x branch, or install an equivalent vendor-backported security update. The upstream fix validates inline image media types using rcube_mime::is_mimetype_valid() before using them in MIME headers.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.