---
id: "CVE-2026-114724"
kind: "vulnerability"
aliases: ["CVE-2026-114724"]
title: "Roundcube Webmail: session parsing flaw enables PHP object injection"
severity: "high"
cvss: 7.4
epss: 0.00262
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "roundcube", "self-hosted", "webmail"]
not_affected_if: ["patched-version"]
published_at: "2026-10-22T02:17:00+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:25:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114724", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114724", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube Webmail: session parsing flaw enables PHP object injection

Roundcube Webmail mishandles session keys prefixed with an exclamation mark, so crafted session data is parsed as a serialized PHP object. An attacker who can influence stored session data may be able to inject PHP objects into the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Roundcube version in the `program/include/iniset.php` file or the release used by your deployment, and compare against `1.6.20` and `1.7.5`.
- Confirm whether the Roundcube instance uses PHP session storage that an attacker could write to (unknown from sources).

## Fix

- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114724
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114724

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_