CVE-2026-35537: roundcube webmail

csirt@kutim:~/threat-intel/cve/CVE-2026-35537

CVSS 7.5 · High EPSS 0,60%

Kerentanan Deserialization of Untrusted Data pada roundcube webmail. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

Rincian

Terbit di NVD: 3 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 0,60% peluang dieksploitasi; lebih tinggi dari 47,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
roundcube	webmail	Semua versi sebelum 1.5.14
roundcube	webmail	Versi 1.6.0 hingga sebelum 1.6.14

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/roundcube/roundcubemail/commit/618c5428edc69fb088e7ac6c89e506dd39df3 patch
https://github.com/roundcube/roundcubemail/commit/6d586cfa4d8a31f7957f7a445aaedd52592a0e74 patch
https://github.com/roundcube/roundcubemail/commit/a4ead994d2f0ea92e4a1603196a197e0d5df1620 patch
https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 advisory pihak ketiga
https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 release notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 release notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 release notes
http://www.openwall.com/lists/oss-security/2026/04/11/6 issue tracking · mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.