CVE-2026-74997
HighCVSS 8.8Summary
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
Risk Assessment
An attacker could exploit this to achieve remote code execution on the server, potentially leading to full compromise of the mail system.
Recommendation
Update Roundcube to version 1.6.18 or 1.7.3 (or later) and disable the cmd_learn driver if not essential.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.