CVE-2026-126813

Roundcube: Schwachstelle ermöglicht Manipulation von Dateien

Open Source Roundcube

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.

11. Nov 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• CERT-Bund
  WID-SEC-2026-4533
• NVD
  CVE-2026-126813