Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data.
Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 6
https://bugs.debian.org/1151279
cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368…
cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/93284f3f0e13f99af37fc3b81861e…
cve@mitre.org
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
cve@mitre.org
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
cve@mitre.org
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
cve@mitre.org