{
  "cveId": "CVE-2026-47762",
  "url": "https://patchblox.com/security/cve/CVE-2026-47762",
  "summary": "CVE-2026-47762 is fixed in roundcubemail on 1 platform by FEDORA-2026-DB7E033531 (version 1.6.20-1.fc43), released November 7, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "roundcubemail: ## Version 1.6.20\n\n- Security: Fix IMAP command injection via CRLF in \u0060_uid\u0060 parameter of mail/headers and mail/views...",
  "description": "## Version 1.6.20\n\n- Security: Fix IMAP command injection via CRLF in \u0060_uid\u0060 parameter of mail/headers and mail/viewsource action\n- Security: Fix bug where an alias login wasn\u0027t qualified by IMAP host\n- Security: Add a size limit to the CSS proxy content processing\n- Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96\n- Security: Fix remote content blocking bypass via SVG SMIL \u0060by\u0060 attribute\n- Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)\n- Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize\n- Security: Fix mail header injection via the From display-name in the Bounce (resend) action\n- Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters\n- Security: Fix object injection primitive in rcube_session::unserialize() via \u0022!\u0022-prefixed session keys\n- Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation\n- Security: Fix CSS scoping bypass in HTML messages using at-rules\n- Security: Fix bug where deprecated action aliases bypassed \u0060disabled_actions\u0060 setting\n- Security: Fix IMAP command injection via CRLF in \u0060_flag\u0060 parameter of mail/mark action\n- Security: Fix CSRF validation bypass in the mark-as-junk action\n- Security: Fix XSS issue in handling of password driver error responses\n- Security: Fix mail header injection via subject of a message forwarded as attachment\n- Security: Fix mail header injection via media type in an inline image data URI\n- Security: Fix bug where Password Modoboa driver could change password for another account\n- Security: Fix unsafe use of a login name in SquirrelMail import file path",
  "published": "2026-10-27T05:56:13Z",
  "severity": "moderate",
  "epss": 0.00281,
  "epssPercentile": 0.20783,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "roundcubemail",
      "release": "Fedora 43",
      "fixedVersion": "1.6.20-1.fc43",
      "fix": "FEDORA-2026-DB7E033531",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-db7e033531",
      "released": "2026-11-07T01:05:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}