PT-2026-29977 · Roundcube · Webmail

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-35538

Mitre

CVSS v3.1

3.1

Low

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-35538

Affected Products

Webmail

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-35538 · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 · Note
• https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64 · Note
• https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c · Note
• https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15 · Note
• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 · Note