Roundcube Webmail accepts IMAP SEARCH command arguments without proper sanitization, which permits an attacker to inject additional IMAP commands or bypass cross‑site request forgery protections when performing a mail search. The vulnerability is rooted in an injection weakness (CWE‑88). The flaw could allow an attacker to attempt unauthorized actions against the IMAP server or the mailbox contents by exploiting the unsanitized input.

All installations of Roundcube Webmail earlier than version 1.5.14 or 1.6.14 are affected. The issue impacts every environment that uses these legacy releases, regardless of operating system or deployment method. Versions 1.5.14, 1.6.14, 1.7‑rc5, and later contain the fix and are not vulnerable.

The CVSS score is 3.1, indicating a low overall severity. An EPSS score below 1% suggests that real‑world exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the webmail interface, where an authenticated user may submit a crafted search query that is transmitted unfiltered to the IMAP server. These conditions are inferred from the description and are not explicitly stated in the source data.