CVE-2026-114724

published 2026-10-22

CVE-2026-114724: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!”…

Priority P3 42 high 7.4 CVSS 3.1

AV L AC H PR N UI N S U C H I H A H

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
roundcube	webmail	>= 1.6.0 < 1.6.20	1.6.20
roundcube	webmail	>= 1.7.0 < 1.7.5	1.7.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502