Roundcube Webmail: Object injection in rcube_session::unserialize (CVE-2026-114724)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() due to improper handling of session keys prefixed with "!".
CVE search metadata
CVE search record: CVE-2026-114724. Severity: high. CVSS: 7.4. KEV: no. Product: Roundcube Webmail (< 1.6.20, 1.7.x < 1.7.5). Brief: Roundcube Webmail: Object injection in rcube_session::unserialize (CVE-2026-114724). Brief link: https://feed.craftedsignal.io/briefs/2026-10-roundcube-object-injection/
Triage facts
Revision 1- Applicability
- Roundcube Webmail (< 1.6.20, 1.7.x < 1.7.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 06:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in the rcube_session::unserialize() function. A session key prefixed with "!" was treated as having no value, resulting in the reconstructed serialized string being emitted with a key but no corresponding value. This desynchronizes the remainder of the input, causing subsequent session data to be interpreted as a serialized value. This provides an object injection primitive for an attacker able to influence stored session data. This has been addressed by upstream by rejecting such keys.