RCE in Roundcube Webmail
CVE-2026-75002
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.023 (82.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 82.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.023 · change: +0.009
Affected products
- Roundcube Webmail — versions 1.6.0, 1.7.0
Weakness classification (CWE)
References
- roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 (Vendor Advisory)
- github.com/roundcube/roundcubemail/releases/tag/1.6.18 (Release Notes)
- github.com/roundcube/roundcubemail/commit/73233abe581b3b31cefd00041c7086c40e179… (Patch)
- github.com/roundcube/roundcubemail/releases/tag/1.7.3 (Release Notes)
- github.com/roundcube/roundcubemail/commit/404d43f1b0125319c3cf8c9e3df39074c0cb8… (Patch)
Frequently asked questions
- What is CVE-2026-75002?
- CVE-2026-75002 is a high-severity vulnerability in Roundcube Webmail, classified under Command Injection. CVSS score: 7.1/10. Published 2026-08-17.
- How severe is CVE-2026-75002?
- High severity. CVSS v3 base score is 7.1 out of 10.