CVE-2026-114725 | Roundcube Webmail up to 1.6.19/1.7.4 Mail Header rcmail_sendmail References/In-Reply-To/Message-ID/From injection

October 22, 2026 Yanac

A vulnerability was found in Roundcube Webmail up to 1.6.19/1.7.4 and classified as problematic. Affected by this vulnerability is the function rcmail_sendmail of the component Mail Header. Executing a manipulation of the argument References/In-Reply-To/Message-ID/From can lead to injection.

This vulnerability appears as CVE-2026-114725. The attack may be performed from remote. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More