Log in Start free

Vulnerability · Published Apr 3, 2026 · Assigned by mitre

CVE-2026-35537

Low 3.7

In plain English

A low-severity unsafe deserialization in Webmail from Roundcube. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 58.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12roundcube1.6.5+dfsg-1+deb12u8DEBIAN-CVE-2026-35537
Debian:13roundcube1.6.15+dfsg-0+deb13u1DEBIAN-CVE-2026-35537
Debian:14roundcube1.6.14+dfsg-1DEBIAN-CVE-2026-35537
Packagistroundcube/roundcubemail1.7-rc5GHSA-rxj3-rrwm-pj4r
Ubuntu:25.10roundcubeno fix listedUBUNTU-CVE-2026-35537
Ubuntu:26.10roundcubeno fix listedUBUNTU-CVE-2026-35537

Affected products (as reported)

VendorProductVersions
Roundcube Webmail 0 – before 1.5.141.6.0 – before 1.6.14

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References