Loading vulnerability…
LDAP Search Filter Injection in Roundcube Webmail
CVE-2026-75007 is an LDAP injection vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3. Values substituted for the %u, %fu, and %d placeholders in LDAP search filters are not properly escaped, potentially allowing attacker-controlled values to alter filter semantics. Successful exploitation may result in information disclosure or privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Manipulation of LDAP search filters may expose information outside the intended search scope or enable privilege escalation. The specific data exposed and privileges attainable depend on the LDAP integration and directory permissions.
If you can’t patch tonight, do this now.
No separate workaround is specified. Apply the vendor or distribution security update promptly. Until patched, review LDAP configurations that use the affected substitution placeholders and limit exposure of LDAP-backed Roundcube functions where operationally feasible.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), install Roundcube version 1.6.18+dfsg-0+deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.