CVE-2026-114725: CWE-99 Improper Control of Resource Identifiers ('Resource Injection') in Roundcube Webmail

CVE-2026-114725 is a mail header injection vulnerability in Roundcube Webmail affecting versions >=1.6.0 <1.6.20 and >=1.7.0 <1.7.5. The vulnerability arises because the rcmail_sendmail function only stripped newline characters from the Subject and Organization headers, but did not sanitize other headers derived from request parameters, including References, In-Reply-To, Message-ID, and From. This allows a remote authenticated attacker to inject arbitrary mail headers into outgoing messages. The upstream fix involved normalizing whitespace in every string header value to prevent injection.

The vulnerability allows a remote authenticated attacker to inject arbitrary headers into outgoing email messages. This can lead to manipulation of email metadata, potentially facilitating phishing, spoofing, or other email-based attacks. There is no direct confidentiality or availability impact reported. The CVSS 3.1 score is 5.0 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, no confidentiality or availability impact, but integrity impact is low.

A fix is available upstream that normalizes whitespace in all string header values to prevent mail header injection. Users should upgrade Roundcube Webmail to versions 1.6.20 or later in the 1.6.x branch, or 1.7.5 or later in the 1.7.x branch to remediate this vulnerability. No other mitigations are specified.