Executive brief
Roundcube Webmail, a widely used open-source email client, is vulnerable to a security flaw in how it handles user sessions when configured to use Redis or Memcache. An attacker can exploit this to write malicious files to the server without needing to log in. This could allow an unauthorized user to disrupt service or potentially gain further access to the email server.
Technical details
A deserialization vulnerability (CWE-502) exists in Roundcube Webmail's session management when using Redis or Memcache backends. The root cause is the unsafe handling of session data, which allows an unauthenticated remote attacker to provide crafted session data that triggers the instantiation of dangerous PHP objects, such as GuzzleHttp\Cookie\FileCookieJar. This can be leveraged to perform arbitrary file write operations on the server. The issue is fixed in versions 1.5.14 and 1.6.14 by disabling the instantiation of the problematic classes during deserialization.
Affected products
- Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14
Timeline
- 2026-03-18: patched: Security updates 1.5.14 and 1.6.14 released.
- 2026-04-03: disclosed: Initial CVE publication.
References
- https://github.com/roundcube/roundcubemail/commit/618c5428edc69fb088e7ac6c89e506dd39df3
- https://github.com/roundcube/roundcubemail/commit/6d586cfa4d8a31f7957f7a445aaedd52592a0e74
- https://github.com/roundcube/roundcubemail/commit/a4ead994d2f0ea92e4a1603196a197e0d5df1620
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
- https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14