🎯 New Report #3913007: SMTP header injection via C-escape `\r` in the recipient display name
🔺Severity: None
👽 Reporter: dogeshark
⭐️ Reputation: 434
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-08-03
⏰ Disclosed: 2026-10-18 12:08:10
📝 Summary: A vulnerability was discovered in Roundcube's email handling where authenticated users could inject arbitrary SMTP headers through the recipient display name field. The issue occurred because the application stripped carriage return and line feed characters before applying a function that converted escaped sequences, allowing a backslash-r sequence to be converted into an actual carriage return after the initial sanitization. This carriage return was then normalized into a full CRLF by the SMTP module, creating valid header lines in the outgoing message. The vulnerability allowed authenticated users to forge email headers such as sender information, add blind carbon copy recipients, and inject false authentication headers or terminate the header block to control message content.
📂 Report JSON File: 3913007
@hackeronereports