CVE-2026-75007
published 2026-08-17CVE-2026-75007: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead…
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.50%
41.9th percentile
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.18 | 1.6.18 |
| roundcube | webmail | >= 1.7.0 < 1.7.3 | 1.7.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Roundcube Webmail up to 1.6.17/1.7.2 LDAP Search Filter ldap injection (Nessus ID 341564)
vuldb·2026-08-31·CVSS 5.4
CVE-2026-75007 [MEDIUM] Roundcube Webmail up to 1.6.17/1.7.2 LDAP Search Filter ldap injection (Nessus ID 341564)
A vulnerability, which was classified as critical, was found in Roundcube Webmail up to 1.6.17/1.7.2. This issue affects some unknown processing of the component LDAP Search Filter. Such manipulation leads to ldap injection.
This vulnerability is traded as CVE-2026-75007. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege e
ghsa_unreviewed·2026-08-17
CVE-2026-75007 [MEDIUM] CWE-77 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege e
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/roundcube/roundcubemail/commit/0893e192adf803c7a5a89fafc80278257e1bcf65https://github.com/roundcube/roundcubemail/commit/e6cc1e121effeaec6d916feb4e019d2828924540https://github.com/roundcube/roundcubemail/releases/tag/1.6.18https://github.com/roundcube/roundcubemail/releases/tag/1.7.3https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
2026-08-17
Published