CVE-2026-35538

Katalog CVE

CVSS 3.1 · Low EPSS 0,36%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada roundcube webmail. Skor CVSS 3.1 3.1 (Low) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber mitre.org
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15 patch
• https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64 patch
• https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 release notes