The vulnerability arises when mail search functions and the LITERAL+ byte-count feature are not properly synchronized in Roundcube Webmail versions prior to 1.6.18 and 1.7.3. This desynchronization allows an attacker to inject arbitrary IMAP commands, which can lead to sensitive information disclosure or escalation of privileges on the mail server. The flaw is a classic command injection (CWE‑77) that bypasses normal command restrictions.

Roundcube Webmail installations running any version before 1.6.18 or before 1.7.3 are affected. Customers should confirm that their deployment is using 1.6.18, 1.7.3, or later releases.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need the ability to send IMAP commands to the affected server, which could be feasible remotely if IMAP is exposed over the Internet. Once the command injection is executed, the attacker may read protected mail or gain higher‑level access depending on the server’s configuration.