CVE-2026-35538 LOW

CVE-2026-35538

Vendor Roundcube

Product Webmail

Weakness CWE-88

Published April 3, 2026

Last update April 3, 2026

View on NVD All CVEs

CVSS base score

3.1/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Key dates

02Disclosure timeline

April 3, 2026 CVE published

April 3, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-35538 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/88.html

Related vulnerabilities

04Related CVE

CVE-2025-32457 ON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument Injection CVE-2026-41013 Tenant-controlled comma smuggles arbitrary CIFS mount options CVE-2025-31499 Jellyfin Vulnerable to Argument Injection in FFmpeg CVE-2023-49096 Argument Injection in FFmpeg codec parameters in Jellyfin CVE-2023-50232 Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability

Identifiers

CVE CVE-2026-35538

CWE CWE-88

CVSS 3.1 / LOW

Affected versions

Vendor Roundcube

Product Webmail

Affected < 1.5.14

Vendor Roundcube

Product Webmail

Affected ≥ 1.6.0 and < 1.6.14