Every CVE Search/ Get API key

CVE-2026-35537

Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

3.7 LowFix available

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.48%Up 0.5 points since Apr 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
CVE-2026-35537
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2026-18575 3.7

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
EUVD-2026-18575
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rxj3-rrwm-pj4r 3.7

Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
GHSA-rxj3-rrwm-pj4r
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
NVD 3.7

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
CVE-2026-35537
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-502
Updated
2026-11-02
OSV 3.7

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
CVE-2026-35537
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
OSVDEBIAN-CVE-2026-35537 7.5

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
DEBIAN-CVE-2026-35537
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-rxj3-rrwm-pj4r 3.7

Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
GHSA-rxj3-rrwm-pj4r
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
OSVUBUNTU-CVE-2026-35537 3.7

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Record
UBUNTU-CVE-2026-35537
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:20586-1 No score

Security update for roundcubemail

This update for roundcubemail fixes the following issues:

Changes in roundcubemail:

  • update to 1.6.15 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability:

    SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

    This version is considered stable and we recommend to update all productive installations of Roundcube 1.6.x with it. Please do backup your data before updating!

    • Fix regression where mail search would fail on non-ascii search criteria (#10121)
    • Fix regression where some data url images could get ignored/lost (#10128)
    • Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke (bsc#1261157)

  • update to 1.6.14 This is a security update to the stable version 1.6 of Roundcube Webmail.

    • Fix Postgres connection using IPv6 address (#10104)
    • Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler (bsc#1261488, CVE-2026-35537)
    • Security: Fix bug where a password could get changed without providing the old password
    • Security: Fix IMAP Injection + CSRF bypass in mail search
    • Security: Fix remote image blocking bypass via various SVG animate attributes
    • Security: Fix remote image blocking bypass via a crafted body background attribute
    • Security: Fix fixed position mitigation bypass via use of !important
    • Security: Fix XSS issue in a HTML attachment preview
    • Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts
Record
openSUSE-SU-2026:20586-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube/roundcubemail
Packagist
 1.7-beta up to 1.7-rc5
1.7-rc5
roundcube
Debian:12
 before 1.6.5+dfsg-1+deb12u8, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 10 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u8
roundcube
Debian:13
 before 1.6.15+dfsg-0+deb13u1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-11.6.14+dfsg-1
1.6.15+dfsg-0+deb13u1
roundcube
Debian:14
 before 1.6.14+dfsg-1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-1
1.6.14+dfsg-1
roundcube/roundcubemail
Packagist
 1.7-beta up to 1.7-rc5, plus listed versions
1.7-beta21.7-rc1.7-rc21.7-rc31.7-rc4
1.7-rc5
roundcube
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1
Show 8 moreShow less
1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8
 None known
roundcube
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1
Show 8 moreShow less
1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2
Show 9 moreShow less
1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6
 None known
roundcube
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2
Show 4 moreShow less
1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
roundcube
Ubuntu:25.10
 All versions, plus listed versions
1.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-1
 None known
roundcube
Ubuntu:26.10
 All versions, plus listed versions
1.6.11+dfsg-1
 None known
roundcube
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1
 None known
roundcubemail
openSUSE:Leap 16.0
 before 1.6.15-bp160.1.1
1.6.15-bp160.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35537 is a low vulnerability (CVSS 3.7) in Bulwarkmail Webmail, published April 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in roundcube/roundcubemail 1.7-rc5.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open