Vulnerability Details CVE-2026-35538
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 10.5%
CVSS Severity
CVSS v3 Score 3.1
References
- https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15
- https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64
- https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
- https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
Products affected by CVE-2026-35538
-
cpe:2.3:a:roundcube:webmail:*
-
cpe:2.3:a:roundcube:webmail:1.6.0
-
cpe:2.3:a:roundcube:webmail:1.6.1
-
cpe:2.3:a:roundcube:webmail:1.6.10
-
cpe:2.3:a:roundcube:webmail:1.6.11
-
cpe:2.3:a:roundcube:webmail:1.6.12
-
cpe:2.3:a:roundcube:webmail:1.6.2
-
cpe:2.3:a:roundcube:webmail:1.6.3
-
cpe:2.3:a:roundcube:webmail:1.6.4
-
cpe:2.3:a:roundcube:webmail:1.6.5
-
cpe:2.3:a:roundcube:webmail:1.6.6
-
cpe:2.3:a:roundcube:webmail:1.6.7
-
cpe:2.3:a:roundcube:webmail:1.6.8
-
cpe:2.3:a:roundcube:webmail:1.6.9