Low severity3.1NVD Advisory· Published Apr 3, 2026· Updated Apr 7, 2026
CVE-2026-35538
CVE-2026-35538
Description
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
roundcube/roundcubemailPackagist | >= 1.7-beta, < 1.7-rc5 | 1.7-rc5 |
Affected products
2Patches
Vulnerability mechanics
References
9- github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15nvdPatchWEB
- github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64nvdPatchWEB
- github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952cnvdPatchWEB
- github.com/advisories/GHSA-8jr8-v43g-5c57ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-35538ghsaADVISORY
- roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14nvdVendor AdvisoryWEB
- github.com/roundcube/roundcubemail/releases/tag/1.5.14nvdRelease NotesWEB
- github.com/roundcube/roundcubemail/releases/tag/1.6.14nvdRelease NotesWEB
- github.com/roundcube/roundcubemail/releases/tag/1.7-rc5nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.