{"id":"CVE-2026-114724","kind":"vulnerability","aliases":["CVE-2026-114724"],"related":[],"title":"Roundcube Webmail: session parsing flaw enables PHP object injection","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.","summary":"Roundcube Webmail mishandles session keys prefixed with an exclamation mark, so crafted session data is parsed as a serialized PHP object. An attacker who can influence stored session data may be able to inject PHP objects into the application.","severity":"high","cvss":7.4,"epss":0.00262,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","roundcube","self-hosted","webmail"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Roundcube version in the `program/include/iniset.php` file or the release used by your deployment, and compare against `1.6.20` and `1.7.5`.\n- Confirm whether the Roundcube instance uses PHP session storage that an attacker could write to (unknown from sources).","fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch.","status":"open","published_at":"2026-10-22T02:17:00+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:25:41+00:00","updated_at":"2026-10-25T03:25:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:25:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch.","reach":"unknown","title":"Roundcube Webmail: session parsing flaw enables PHP object injection","impact":"high","summary":"Roundcube Webmail mishandles session keys prefixed with an exclamation mark, so crafted session data is parsed as a serialized PHP object. An attacker who can influence stored session data may be able to inject PHP objects into the application.","category":"package","nicknames":[],"who_cares":["roundcube","webmail","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects PHP objects, possibly leading to code execution on the server.","analyst_note":"Check the NVD entry and the upstream commit for the exact attacker precondition on session data and any public exploit details.","how_to_check":"- Check the installed Roundcube version in the `program/include/iniset.php` file or the release used by your deployment, and compare against `1.6.20` and `1.7.5`.\n- Confirm whether the Roundcube instance uses PHP session storage that an attacker could write to (unknown from sources).","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Roundcube Webmail installations before 1.6.20 and 1.7.x before 1.7.5 are affected. The exposure depends on whether an attacker can influence stored session data, which the sources do not detail further; instances that already run the fixed releases are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3474,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114724':12A,15A '-2026':11A,14A '1.6.20':65C '1.7':67C '1.7.5':70C 'abl':54B,132C 'applic':61B 'attack':45B,131C 'commit':143C 'contain':71C 'correspond':103C 'craft':34B 'cve':10A,13A 'data':36B,51B,115C,137C 'desynchron':105C 'emit':97C 'enabl':6A 'exclam':31B 'fix':139C,144C 'flaw':5A 'follow':113C 'host':21B 'influenc':48B,134C 'inject':9A,56B,74C,127C,146C 'input':110C 'interpret':117C 'key':27B,82C,100C,155C,159C 'mark':32B 'may':52B 'mishandl':25B 'object':8A,43B,58B,73C,126C,145C 'packag':16B 'pars':4A,38B 'php':7A,17B,42B,57B,125C 'prefix':28B,83C,153C 'primit':75C,128C,147C 'rcube':77C,149C 'reconstruct':93C 'reject':157C 'remaind':107C 'roundcub':1A,18B,23B,62C 'self':20B 'self-host':19B 'serial':41B,94C,120C 'session':3A,26B,35B,50B,78C,81C,114C,136C,150C,154C 'store':49B,135C 'string':95C 'treat':86C 'unseri':79C,151C 'upstream':138C 'valu':90C,104C,121C 'via':152C 'webmail':2A,22B,24B,63C 'x':68C 'yield':123C","nicknames":[],"mitigations":[],"who_affected":"Roundcube Webmail installations before 1.6.20 and 1.7.x before 1.7.5 are affected. The exposure depends on whether an attacker can influence stored session data, which the sources do not detail further; instances that already run the fixed releases are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114724","severity":null,"published_at":"2026-10-22T02:17:00+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114724","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114724","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}