CVE Catalog
CVE-2026-75007
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.25%
16th percentile - higher than 16% of all known CVEs
Summary
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to LDAP search filter injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
Risk Assessment
Risk of unauthorized LDAP data access and potential privilege escalation in the mail environment.
Recommendation
Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 and validate LDAP configuration inputs.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.