Roundcube Webmail versions prior to 1.6.20 and 1.7.5 allow a remote authenticated attacker to embed carriage‑return line‑feed sequences in the media type of an inline image data URI. The extraction routine then accepts this unvalidated media type and injects the embedded CRLFs as MIME part headers into the outgoing message. The attacker can therefore add arbitrary headers such as To, CC, From, X-Header or any custom header, enabling email forging, manipulation of delivery, or delivery of malicious payloads. This vulnerability is an input validation issue (CWE-99) that affects the confidentiality and integrity of outbound email communications.

Roundcube Webmail v1.6.x before 1.6.20 and v1.7.x before 1.7.5 are vulnerable. Any installation of these releases that permits sending emails with inline images is susceptible to exploitation.

The CVSS score of 8.5 indicates high severity. EPSS is low at < 1% and the flaw is not listed in CISA KEV. The attack requires the attacker to be a logged‑in user capable of composing an email containing an inline image. Once authenticated, the attacker can craft the media type to inject headers, making exploitation straightforward if the user can send such an email. The vulnerability is likely to be exploitable because the attack vector is directly exposed through the user interface that accepts inline images. The risk remains high until the patch is applied.