PT-2026-29977 · Roundcube+1 · Roundcube Webmail+1

Nullcathedral · Published 2026-03-18 · Updated 2026-05-07 · CVE-2026-35538

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.14 and prior to 1.6.14

Description A flaw exists in Roundcube Webmail that may allow for IMAP injection or CSRF bypass during mail search due to unsanitized IMAP SEARCH command arguments.

Recommendations Update Roundcube Webmail to version 1.5.14 or later. Update Roundcube Webmail to version 1.6.14 or later.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2026-06182

CVE-2026-35538

GHSA-8JR8-V43G-5C57

Affected Products

Red Os

Roundcube Webmail

References · 19

• https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c · Patch
• https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64 · Patch
• https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-35538 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35538 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35538 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35538 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06182 · Security Note
• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35538 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35538 · Security Note
• https://osv.dev/vulnerability/GHSA-8jr8-v43g-5c57 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 · Note