CVE-2026-35537
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Published Apr 3, 2026 · updated Jul 24, 2026 · roundcube webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 3, 2026 · NIST NVD
Detected
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Jul 24, 2026 · NIST NVD
Updated
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Affected
- cpe roundcube/webmailversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-35537
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-35537
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
nvd.nist.gov