CVE Catalog
CVE-2026-35537
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk0.48%
38th percentile - higher than 38% of all known CVEs
Summary
Roundcube Webmail before versions 1.5.14 and 1.6.14 has an unsafe deserialization vulnerability in the redis/memcache session handler, which can lead to arbitrary file write operations by unauthenticated attackers.
Risk Assessment
The risk involves potential remote code execution or malicious file writes by an unauthenticated attacker, which could lead to full server compromise.
Recommendation
Immediately update Roundcube to version 1.5.14 or 1.6.14 and implement a more secure session handler.
Original NVD description (English source)
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.