Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-17T13:16:54.747Z",
  "pubdate": "2026-08-17T13:16:54.747Z",
  "executiveSummary": "A vulnerability exists in Roundcube Webmail affecting versions prior to 1.6.18 and 1.7.x prior to 1.7.3, specifically involving mail search functionalities and the handling of IMAP LITERAL+ byte-counts. This security flaw stems from a desynchronization issue between the web application's parsing logic and the underlying IMAP server interpretation of command streams.\nThe primary impact of this vulnerability includes potential information disclosure and privilege escalation through crafted IMAP command injection. An attacker capable of exploiting this mechanism can manipulate the communication channel between the Roundcube backend and the upstream IMAP server, leading to unauthorized command execution within the IMAP session context.\nAffected systems comprise Roundcube Webmail deployments running vulnerable versions 1.6.x before 1.6.18 and 1.7.x before 1.7.3. The risk implications are severe, as successful exploitation undermines the integrity of mail search operations and allows unauthorized interactions with the mail server.\nAttacker capabilities involve crafting specialized input during mail search queries that leverage LITERAL+ syntax desynchronization. Exploitation requirements necessitate the ability to supply malicious input parameters processed by the webmail application's IMAP client handler, potentially requiring authenticated access depending on the application configuration and entry points.",
  "technicalDetails": "The vulnerability resides within the mail search and IMAP protocol handling components of Roundcube Webmail. Specifically, it involves the misuse or improper validation of the IMAP LITERAL+ extension syntax (represented by the use of literal data sizes in curly braces, such as {count+}), which allows clients to send large strings or binary data efficiently.\nThe root cause is a byte-count desynchronization flaw. When Roundcube constructs IMAP commands for mail search operations based on user-supplied parameters, insufficient sanitization or improper tracking of data boundaries can cause the parser to misinterpret the length of LITERAL+ data streams. This discrepancy allows arbitrary or unintended IMAP commands to be injected directly into the command pipeline sent to the backend mail server.\nThe attack flow proceeds as follows: First, the attacker supplies a maliciously crafted input string designed to trigger a byte-count mismatch during a mail search operation. Second, Roundcube formats the search query utilizing the LITERAL+ syntax, inadvertently incorporating the injected payload due to the desynchronization logic. Third, the resulting data stream sent to the IMAP server treats the injected content as discrete, authenticated IMAP commands rather than mere search parameters.\nVulnerable components include the IMAP client abstraction layer and mail search query generators within Roundcube Webmail versions prior to 1.6.18 and 1.7.x prior to 1.7.3. Network exposure involves the web application server acting as an intermediary communicating with an IMAP server, typically over standard or encrypted TCP ports (IMAPS/IMAP).\nAuthentication and privilege requirements depend on the specific deployment vector, but exploitation generally assumes an attacker can interact with the mail search interface, either as an authenticated user or via exposed application endpoints depending on preceding vulnerabilities. Post-exploitation impact encompasses unauthorized information disclosure, such as unauthorized access to mailbox data, or privilege escalation within the context of the mail server session."
}