Live › vulnerability › CVE-2026-114724
Go to dashboardRoundcube Webmail mishandles session keys prefixed with an exclamation mark, so crafted session data is parsed as a serialized PHP object. An attacker who can influence stored session data may be able to inject PHP objects into the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Roundcube Webmail installations before 1.6.20 and 1.7.x before 1.7.5 are affected. The exposure depends on whether an attacker can influence stored session data, which the sources do not detail further; instances that already run the fixed releases are not affected.
No product ranges from the sources yet.
program/include/iniset.php file or the release used by your deployment, and compare against 1.6.20 and 1.7.5.1.6.20 on the 1.6 branch or 1.7.5 on the 1.7 branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-114724")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.