CVE-2026-35537: Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
Published Apr 3, 2026
·Updated
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Other sources
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
— Packagist
Affected Software
4 affected componentsFixes available
composer/roundcube/roundcubemail>=1.7-beta<1.7-rc5
1.7-rc5
Roundcube Webmail<1.5.14
Roundcube Webmail>=1.6.0<1.6.14
composer/roundcube/roundcubemail>=1.7-beta, <1.7-rc5
1.7-rc5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/roundcube/roundcubemailto a version that resolves this vulnerability.Fixed in 1.7-rc5
Event History
Apr 3, 2026
CVE Published
via MITRE·03:28 AM
Data Sourced
via MITRE·03:28 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 AM
Data Sourced
via GitHub·06:31 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Packagist·06:31 AM
DescriptionSeverityAffected Software