psf-roundcube-oct2026-check(8)

Script: /opt/psf-security-patches/roundcube/roundcube-oct2026-check.sh. Tool page: Roundcube. Source. With the package installed: man psf-roundcube-oct2026-check.

Roundcube Webmail 1.6.20 and 1.7.5 security release: read-only checker  (v1)
CVE-2026-114716 (mail header injection, CVSS 8.5)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Roundcube released 1.6.20 (LTS) and 1.7.5 (mainline) on 19 October 2026. Both
carry the same 20 security fixes, the largest batch since 1.7.0: IMAP command
injection, four mail header injection flaws, XSS, SSRF, CSRF, an object
injection primitive in session handling and ImageMagick limit bypasses.
CVE-2026-114716 is one of the mail header injection fixes (the release notes
list header injection through the From display-name in Bounce, through the
References, In-Reply-To, Message-ID and From parameters, through the subject
of a message forwarded as an attachment, and through the media type of an
inline image). A header injection lets an attacker add or alter headers of an
outgoing message, which feeds phishing and mail forgery from a trusted host.

  Affected: Roundcube 1.6.x before 1.6.20, and 1.7.x before 1.7.5
  Fixed:    1.6.20 and 1.7.5. These releases do not cover 1.5 and earlier.

Roundcube is bundled by hosting panels. cPanel and Plesk ship their own copy
and update it with the panel, so the panel's changelog decides when it is safe.

This script is read-only. It finds Roundcube installs, reads the version from
program/include/iniset.php, and can search web server logs for CRLF probing
of the _uid and _flag parameters (the IMAP injection that the same release
fixes), which is a sign someone has been testing your webmail.

Usage:
  ./roundcube-oct2026-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /var/www /srv /opt /home
                   /usr/share/roundcube /usr/share/roundcubemail
                   /var/lib/roundcube plus the cPanel and Plesk paths).
                   Exit 0 = nothing affected, 1 = an affected install found.
  hunt             search readable web server logs for _uid or _flag values
                   that contain an encoded carriage return or line feed.
                   Exit 0 = none found, 1 = matches found.
  version          print the script version.

Distribution packages backport fixes without changing the version string. The
script reads the owning package changelog and reports a mention of the CVE.
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.