CVE-2026-75002

Executive Summary

CVE-2026-75002 is an IMAP command injection vulnerability in Roundcube Webmail affecting all releases before 1.6.18 and the 1.7.x branch before 1.7.3. The flaw resides in the interaction between the mail search feature and IMAP LITERAL+ non-synchronizing literals; a byte-count desynchronization allows an attacker with a low-privileged webmail account to inject arbitrary IMAP commands into the backend mail server session. Successful exploitation results in information disclosure or privilege escalation, with a CVSS score of 7.1 (High) reflecting high confidentiality and integrity impact against a network-exposed, public-facing web application.

Organizations running self-hosted Roundcube Webmail deployments are directly affected. Exploitation requires network access, a valid low-privileged account, and a high degree of attack complexity, but the reward is access to any mailbox data or IMAP operations permitted within the compromised session — making this a high-priority target for enterprise and government webmail environments. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing has been confirmed as of this report; EPSS has not yet been scored by FIRST.org.

Technical Analysis

The vulnerability class is IMAP command injection (CWE-77, Improper Neutralization of Special Elements used in a Command). Roundcube Webmail acts as a PHP-based client that translates user actions — including mailbox search — into IMAP protocol commands relayed to a backend mail server. The mail search feature accepts user-controlled search criteria and serializes them into IMAP SEARCH requests. Under certain conditions, the serialization process mishandles LITERAL+ literals, causing a desynchronization between the declared byte count and the actual bytes transmitted to the server.

In the IMAP protocol, a literal is expressed as {<byte-count>} followed by exactly that number of bytes. The LITERAL+ extension ({<byte-count>+}) explicitly tells the server that the client will emit the bytes immediately without waiting for a continuation response. This is a performance optimization that introduces a parser trust assumption: the byte count prefaces a fixed, self-contained block of data. When an application constructs a LITERAL+ whose declared byte count diverges from the real payload (or when the surrounding serialization logic permits embedded CRLF sequences to leak out of the literal boundary), the IMAP server's parser can become desynchronized. The attacker-controlled content can then terminate the literal early and introduce additional, fully-formed IMAP commands that the server interprets as legitimate protocol commands rather than command arguments.

The attack surface is the HTTP-facing Roundcube webmail interface, specifically the mail search capability — one of the most commonly exercised functions in any webmail product. The attacker must already hold a valid account on the webmail system (CVSS PR:L), but requires no user interaction from victims (UI:N). Network reachability to the web service is sufficient; the injected commands traverse the trusted server-side channel between the Roundcube application and the IMAP backend, so the mail server treats them as originating from the webmail application itself with full trust.

The practical consequence is a classic command-injection lateral movement: an attacker who can control a low-value or throwaway mailbox account may escalate to reading and manipulating other users' mail by injecting IMAP SEARCH, FETCH, SELECT, or similar commands into the victim session's command stream. The precise parameter name, the exact serialization routine, and the specific IMAP command sequences that trigger the desynchronization have not been published in the NVD description, so this report deliberately describes the mechanism at the protocol level rather than attributing specific function or endpoint names. Insufficient technical detail is available to name internal code locations.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-75002; the attack chain below is inferred strictly from the vulnerability class (IMAP command injection via LITERAL+ byte-count desynchronization in the mail search feature) and is provided to guide detection and threat modeling.

1. Reconnaissance / target identification. The attacker fingerprints Roundcube Webmail instances using banners, HTTP title attributes ("Roundcube Webmail"), login page markup, and Shodan/Fofa dorks. Version identification is performed via the login page footer or static asset URLs; targets running versions below 1.6.18 or 1.7.0–1.7.2 are shortlisted. The CVE requires a valid account, so the attacker simultaneously harvests credentials via credential stuffing, phishing, or controlled low-privilege account registration if the deployment permits self-registration.

2. Triggering the flaw. The attacker authenticates to the webmail interface and navigates to the mail search functionality. A crafted search string is submitted that embeds IMAP LITERAL+ literal syntax ({<n>+}) containing a deliberate byte-count mismatch, plus CRLF-delimited IMAP command fragments. Because the mail search feature forwards the user-controlled string into the IMAP command stream, the mismatched literal byte count desynchronizes the IMAP parser state on the backend. The exact search parameter and payload format are not publicly documented; at the vulnerability-class level, the payload must cause the parser to exit the literal early and interpret the trailing data as new protocol commands.

3. Payload / execution method. Once the parser is desynchronized, the attacker's appended command fragments are executed by the IMAP server as if issued by the Roundcube service account. Class-level payloads include injected SELECT (selecting other mailboxes), UID FETCH (retrieving message bodies), UID SEARCH (enumerating messages across folders), and STORE/COPY (modifying or exfiltrating mailbox content). Because the injection rides the already-authenticated IMAP session, no additional credentials are required at this stage.

4. Post-exploitation impact. The attacker gains the ability to read arbitrary messages reachable by the compromised session, copy mailbox data out of the organization, and in cases where the webmail service account has elevated permissions, escalate to administrative mailbox management or access other tenants on shared IMAP infrastructure. In multi-tenant deployments (hosting providers), this could chain into cross-tenant data compromise. The attacker's actions are logged as legitimate IMAP activity from the Roundcube server, degrading forensic attribution.

Impact Assessment

The CVSSv3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L yields a base score of 7.1 (High). The dominant concerns are Confidentiality: High and Integrity: High. Confidentiality is the primary business risk — webmail contains sensitive corporate, legal, and personal communications; injected IMAP FETCH/SEARCH commands allow the attacker to silently enumerate and extract messages from mailboxes other than their own. Integrity: High reflects the ability to inject commands that modify mailbox state (deleting, moving, or copying messages), which can corrupt records, destroy evidence, or stage further attacks such as email-based supply-chain compromise. Availability: Low reflects that the injection is command-oriented and does not inherently facilitate denial of service, though an attacker could in theory issue destructive commands.

The blast radius is constrained by the authentication requirement (PR:L) — only organizations where an attacker can first obtain a low-privileged account are directly at risk. However, in practice the combination of a public-facing service and common credential-compromise techniques means this constraint is frequently satisfied. The attack originates from low-privileged accounts, meaning ANY user on the webmail system is a potential entry point. The high attack complexity (AC:H) and the absence of a public PoC temper immediate mass-exploitation likelihood, but the deployment base of Roundcube — including many government, academic, and small-to-mid-enterprise mail infrastructure providers — makes this a strategically important CVE for blue teams to monitor.

Detection Guidance

Sigma Rule

title: Roundcube IMAP Command Injection Attempt (CVE-2026-75002)
id: 2fc4f0a6-8b3c-4e5a-9d12-7c6a9b3f5e01
status: experimental
description: Detects HTTP requests to webmail search functionality containing IMAP LITERAL+ syntax combined with IMAP command keywords, indicative of CVE-2026-75002 exploitation.
logsource:
  category: webserver
  product: apache
detection:
  selection_literal:
    cs-uri-query|re: '\{[0-9]{1,10}\+\}'
  selection_commands:
    cs-uri-query|contains|all:
      - 'SEARCH'
      - 'SELECT'
      - 'FETCH'
      - 'STORE'
      - 'COPY'
  selection_endpoint:
    cs-uri-query|contains:
      - 'search'
      - '_action=search'
  condition: selection_endpoint and selection_literal and selection_commands
  timeframe: 5m
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
  - cs-host
falsepositives:
  - Legitimate search queries that coincidentally contain the substrings 'SELECT' or 'FETCH' in email content
level: high
tags:
  - attack.t1190
  - cve.2026-75002
  - cwe.77

YARA Rule

rule CVE_2026_75002_Roundcube_IMAP_Command_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payloads and logs containing IMAP LITERAL+ byte-count desynchronization and command injection patterns for CVE-2026-75002"
        cve = "CVE-2026-75002"
        severity = "high"
        date = "2026-01-01"

    strings:
        $literal_plus = /\{[0-9]{1,10}\+\}/
        $cmd_select   = /(?i)(^|\s|\r\n)SELECT /
        $cmd_fetch    = /(?i)(^|\s|\r\n)(UID )?FETCH /
        $cmd_search   = /(?i)(^|\s|\r\n)(UID )?SEARCH /
        $cmd_store    = /(?i)(^|\s|\r\n)STORE /
        $cmd_copy     = /(?i)(^|\s|\r\n)COPY /
        $crlf_cmd     = /(\r\n|\n)[A-Z][A-Z0-9 ]*\r\n/

    condition:
        any of ($cmd*) and ($literal_plus or $crlf_cmd)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2026-75002 - Roundcube Webmail IMAP Command Injection via LITERAL+ Desync (Inbound)";
    flow:established,to_server;
    content:"search"; nocase; http_uri;
    pcre:"/\{[0-9]{1,10}\+\}/i";
    pcre:"/(SELECT|FETCH|SEARCH|STORE|COPY)\s/i";
    classtype:web-application-attack;
    reference:cve,2026-75002;
    sid:10075002;
    rev:1;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.category == "web" and network.protocol == "http"
    and http.request.method == "POST"
    and wildcard(http.request.uri, "*search*")
    and (wildcard(http.request.body, "*{*+*}*"))
    and (wildcard(http.request.body, "*SEARCH*") or wildcard(http.request.body, "*FETCH*")
         or wildcard(http.request.body, "*SELECT*") or wildcard(http.request.body, "*STORE*")) ]
  [ authentication where event.category == "authentication" and event.outcome == "success"
    and process.name == "php-fpm" ]

Splunk SPL Query

index=web* sourcetype=access_combined
| regex _raw="\{[0-9]{1,10}\+\}"
| regex _raw="(?i)((UID[[:space:]])?(SEARCH|FETCH|SELECT|STORE|COPY))"
| regex _raw="(?i)(search|_action=search)"
| eval score = 0
| eval score = score + 3
| stats sum(score) as threat_score count as event_count values(uri) as uris
        by src_ip, host, user_agent, _time
| where threat_score >= 3 AND event_count > 1
| sort - _time
| table _time src_ip host uris user_agent threat_score event_count

Additionally, on the IMAP backend:

index=mail sourcetype=imap*
| regex _raw="\{[0-9]{1,10}\+\}"
| regex _raw="(?i)(SELECT|FETCH|SEARCH|STORE|COPY)"
| stats count by src_ip, dest_ip, _time
| where count > 5

Wazuh OSSEC Rule

<group name="web,roundcube,cve,cwe77,">
  <rule id="888395" level="10">
    <decoded_as>web-access</decoded_as>
    <match>search</match>
    <regex>(\{[0-9]{1,10}\+\})|((UID[[:space:]])?(SEARCH|FETCH|SELECT|STORE|COPY))</regex>
    <description>CVE-2026-75002: Roundcube Webmail IMAP command injection attempt (LITERAL+ desynchronization) detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>roundcube_imap_injection,pci_dss_6.5,gdpr_32</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence has been identified from any tracked source. The NVD description references version constraints (fixed in 1.6.18 and 1.7.3), which are the implied patched releases, but these have not yet been independently confirmed by vendor advisory, OSV package data, or patch-tracker evidence. Consequently, do not treat the upgrade path as fully verified until the Roundcube project publishes an official advisory.

1. Immediate mitigations (compensating controls):

   • Restrict access to Roundcube Webmail to trusted networks via VPN, reverse-proxy allowlists, or geo-fencing where operationally feasible.
   • Deploy WAF virtual patching: block HTTP requests to search endpoints containing {<digits>+} patterns or embedded IMAP command keywords (SELECT, FETCH, SEARCH, STORE, COPY) in query strings or POST bodies.
   • Enforce MFA on all webmail accounts to raise the bar for obtaining the prerequisite PR:L foothold.
   • Review and revoke mailbox/IMAP service-account privileges; connect Roundcube to mail servers using the least-privileged service account possible.
   • Enable verbose Roundcube and IMAP proxy logging; tune the detection rules above and alert on any hits immediately.

2. Patch / upgrade steps:

   • Monitor the official Roundcube project — once 1.6.18 or 1.7.3 is verified and released on https://roundcube.net, upgrade all production instances immediately.
   • If the organization is on the 1.7.x branch, plan a direct path to 1.7.3+; older branches should move to 1.6.18+.
   • Validate the integrity of downloaded packages via the provider's published checksums; stage in a pre-production environment with identical IMAP backend configuration before deployment.

3. Long-term hardening:

   • Establish a formal patch-management cadence for webmail infrastructure, including automated notifications for Roundcube security advisories.
   • Segment the network architecture so the web tier can only communicate with the IMAP tier over a controlled, monitored channel; restrict outbound IMAP from application servers to the approved mail server only.
   • Implement IMAP protocol anomaly detection on the mail server side (e.g., unexpected command sequences immediately following literals, abnormal SEARCH/FETCH volumes from service accounts).
   • Enforce periodic privileged-account reviews, and ensure webmail service accounts cannot be used for administrative mailbox operations unless strictly required.
   • Subscribe to CISA KEV updates and FIRST.org EPSS feeds; reassess exposure when EPSS scoring becomes available or if exploit activity is observed in the wild.

References

1. NVD — CVE-2026-75002: https://nvd.nist.gov/vuln/detail/CVE-2026-75002
2. CVE.org Record — CVE-2026-75002: https://www.cve.org/CVERecord?id=CVE-2026-75002
3. MITRE CWE-77 — Improper Neutralization of Special Elements used in a Command: https://cwe.mitre.org/data/definitions/77.html
4. Roundcube Project (official site, security advisories and release announcements): https://roundcube.net/news/
5. ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Known threat-actor campaigns or exploit-in-the-wild evidence: none confirmed. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, EPSS has not yet been scored, no public PoC or Nuclei template exists, and no exploit code has been observed as of this report.