Deserialization of Untrusted Data in Roundcube Webmail - #VU124136
Published: March 19, 2026
Vulnerability identifier: #VU124136
CSH Severity: Critical
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code or write arbitrary files.
The vulnerability exists due to unsafe deserialization in redis/memcache session handler when processing session data. A remote attacker can send a specially crafted session payload to execute arbitrary code or write arbitrary files.
No authentication is required to exploit this vulnerability.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.5.14, 1.6.14