Roundcube Webmail contains a flaw that permits remote, authenticated users to inject CRLF sequences into the _uid parameter for the mail/headers and mail/viewsource actions. The injected CRLF terminates the previous IMAP command and introduces a new arbitrary command, enabling the attacker to execute any IMAP command supported by the mail server. This flaw can lead to unauthorized reading, deletion, or modification of mailbox contents. The vulnerability is classified as CWE‑93.

Roundcube Webmail versions earlier than 1.6.20, and all 1.7.x releases before 1.7.5 are affected. The problem is confined to the Roundcube PHP application and is independent of the operating system on which it runs.

The CVSS base score of 7.1 indicates a moderate to high impact. The EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation remains uncertain. Attackers must authenticate to the webmail interface to reach the vulnerable parameter, after which they can submit arbitrary IMAP commands to the upstream server.