CVE-2026-35537: Roundcube Webmail unsafe deserialization in session handler

CVE-2026-35537 · Severity: low · CVSS 3.7 · Published 2026-04-03

Roundcube Webmail, a widely used open-source email client, is vulnerable to a security flaw in how it handles user sessions when configured to use Redis or Memcache. An attacker can exploit this to write malicious files to the server without needing to log in. This could allow an unauthorized user to disrupt service or potentially gain further access to the email server.

Technologies: roundcube/roundcubemail (Packagist), Roundcube Webmail. Vendors: Packagist, Roundcube.

Quick answers

Is CVE-2026-35537 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35537 being exploited in the wild.
How severe is CVE-2026-35537?
Low severity, with a CVSS score of 3.7, published 3 April 2026.
Which products and versions are affected?
roundcube/roundcubemail (Packagist) >= 1.7-beta, < 1.7-rc5, ECOSYSTEM:introduced=1.7-beta,fixed=1.7-rc5; Roundcube Webmail < 1.5.14, >= 1.6.0 < 1.6.14, >= 1.7-beta < 1.7-rc5, < 1.5.14, 1.6.x < 1.6.14.
Is there a fix for CVE-2026-35537?
Yes. roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35537 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-35537?
Check whether you run roundcube/roundcubemail (Packagist) or Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later
    composer require roundcube/roundcubemail:^1.7-rc5

Technical details

A deserialization vulnerability (CWE-502) exists in Roundcube Webmail's session management when using Redis or Memcache backends. The root cause is the unsafe handling of session data, which allows an unauthenticated remote attacker to provide crafted session data that triggers the instantiation of dangerous PHP objects, such as GuzzleHttp\Cookie\FileCookieJar. This can be leveraged to perform arbitrary file write operations on the server. The issue is fixed in versions 1.5.14 and 1.6.14 by disabling the instantiation of the problematic classes during deserialization.

Affected products

  • Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14

Identifiers

  • CVE-2026-35537
  • GHSA-rxj3-rrwm-pj4r

Timeline

  • 2026-03-18: patched: Security updates 1.5.14 and 1.6.14 released.
  • 2026-04-03: disclosed: Initial CVE publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.