CVE-2026-35538

LOW EPSS 20.0%
Published Apr 3, 20262mo ago · Modified Jun 17, 20262w ago
3.1 CVSS 3.1
Low
Find Similar
Published Apr 3, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

CVSS Details

Base Score
3.1
Exploitability
1.6
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
20.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-88

Affected Products 2

VendorProductVersionRange
roundcubewebmail* <1.5.14
roundcubewebmail*≥1.6.0  –  <1.6.14

References 7

  • github.com https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15
    Patch
  • github.com https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64
    Patch
  • github.com https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c
    Patch
  • github.com https://github.com/roundcube/roundcubemail/releases/tag/1.5.14
    Release Notes
  • github.com https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
    Release Notes
  • github.com https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
    Release Notes
  • roundcube.net https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
    Vendor Advisory

Remediation

  • github.com https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15
    Patch
  • github.com https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64
    Patch
  • github.com https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c
    Patch