CVE-2026-114724 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 represents a critical security flaw rooted in the improper handling of serialized data within the session management subsystem. Specifically, the issue resides in the rcube_session::unserialize() method, which is responsible for reconstructing PHP objects from stored session strings. The core technical deficiency involves how the application processes session keys that are prefixed with an exclamation mark character. In standard PHP serialization formats, a key followed by no value typically indicates a null or empty state, but Roundcube’s implementation incorrectly handled this edge case during deserialization. When a session key was found to be prefixed with "!", the system treated it as having no associated value and subsequently emitted the reconstructed serialized string containing that key without its corresponding value field.
This specific handling error leads directly to a severe desynchronization of the remaining input data stream. Because the parser incorrectly consumed or skipped part of the serialization structure due to the missing value, all subsequent session data was misinterpreted as being part of a serialized object rather than distinct key-value pairs. This structural corruption creates an opening for PHP Object Injection attacks. An attacker who can influence stored session data, which is often possible through cross-site scripting vulnerabilities or other means that allow manipulation of client-side cookies and local storage used by the webmail interface, can craft malicious payloads designed to exploit this desynchronization. By carefully constructing a serialized string with a "!"-prefixed key followed by specific object definitions, an attacker can trick the application into instantiating arbitrary PHP objects during session restoration.
The operational impact of this vulnerability is significant as it allows for remote code execution under certain conditions where vulnerable classes are available in the application environment. This falls squarely under CWE-502, which describes Deserialization of Untrusted Data, and aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter subtechniques if the injected objects lead to arbitrary command execution. The ability to inject PHP objects enables attackers to bypass authentication mechanisms, escalate privileges within the application context, or access sensitive user data stored in session variables that were previously inaccessible due to permission checks on legitimate object types.
To mitigate this risk, organizations running Roundcube Webmail must upgrade immediately to version 1.6.20 or later for the stable branch and version 1.7.5 or later for the development branch. The upstream fix explicitly addresses this issue by rejecting session keys that are prefixed with "!" during the deserialization process, thereby preventing the malformed serialization structure from being processed further. In addition to upgrading, administrators should ensure that PHP error reporting is configured appropriately in production environments to avoid leaking stack traces that could aid attackers in identifying vulnerable classes for gadget chain construction. Regular security audits and input validation on all session-related data sources are also recommended to prevent initial compromise vectors such as XSS that might allow an attacker to inject the malicious serialized payloads required to trigger this vulnerability.