Loading vulnerability…
Pre-auth arbitrary file write in Roundcube Redis/Memcache session handler
CVE-2026-35537 affects Roundcube Webmail before versions 1.5.14 and 1.6.14, with 1.7 pre-release versions also reported as affected. The vulnerability is caused by unsafe deserialization in the Redis/Memcache session handler. According to the provided content, an unauthenticated attacker can supply crafted session data that is deserialized unsafely, leading to an arbitrary file write condition prior to authentication. The issue was reported by y0us and was fixed in Roundcube 1.5.14 and 1.6.14.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to perform arbitrary file write operations on the Roundcube server through crafted session data processed by the Redis/Memcache-backed session handler. Depending on deployment details, arbitrary file write can enable application compromise, tampering with server-side files, persistence, denial of service, or potentially follow-on code execution if attacker-controlled content can be written to a sensitive or executable location.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or avoiding the Redis/Memcache session handler where feasible and using a non-affected session storage backend. Restrict network and administrative access to Redis/Memcache services so attackers cannot influence session data through those components. Monitor for anomalous session data and unexpected file creation or modification in Roundcube and web-accessible directories. These are interim measures only; patching to a fixed release is the primary mitigation.
Patch, then assume compromise.
Upgrade Roundcube to version 1.5.14 or 1.6.14 or later. The provided content also notes that versions 1.5.15 and 1.6.15 were later released to correct regressions introduced in 1.5.14 and 1.6.14, so the preferred remediation is to deploy 1.5.15, 1.6.15, or a newer supported release. Ensure that any affected 1.7 pre-release builds are updated to a fixed version as well.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.