CVE-2026-35538

LowCVSS 3.1

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

An issue was discovered in Roundcube Webmail before versions 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Risk Assessment

An attacker could exploit this vulnerability to perform unauthorized operations on the IMAP server or bypass CSRF protections, potentially leading to data theft or session hijacking.

Recommendation

Immediately update Roundcube Webmail to version 1.5.14 or 1.6.14, which include fixes for this vulnerability.

Original NVD description (English source)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.