CVE-2026-35538lowCWE-88

CVE-2026-35538: falha de baixa gravidade em Roundcube Webmail

Publicada em 03 abr 2026

Seguir esta CVE + Monitorar Webmail + Monitorar roundcube

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.4%

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

Roundcube · Webmail

CVEs relacionadas — Roundcube Webmail

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49113CRITICALCVE-2025-49113EPSS 99.5%KEV CVE-2025-68461HIGHCVE-2025-68461EPSS 27.4%KEV CVE-2026-48842HIGHCVE-2026-48842EPSS 1.7%CVE-2026-75002HIGHCVE-2026-75002EPSS 1.4%CVE-2026-113386HIGHCVE-2026-113386EPSS 1.0%CVE-2026-114720HIGHCVE-2026-114720EPSS 0.8%

Referências

https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15 https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64 https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14