CVE-2026-35537: 
PHP vulnerability analysis and mitigation

CVE-2026-35537 is a pre-authentication arbitrary file write vulnerability in Roundcube Webmail caused by unsafe deserialization in the redis/memcache session handler. It affects all versions before 1.5.14 and versions 1.6.0 through 1.6.13. The vulnerability was disclosed on April 3, 2026, with patches released on March 18, 2026 as part of versions 1.5.14, 1.6.14, and 1.7-rc5. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Roundcube 1.6.14 Release).

The root cause is deserialization of untrusted data (CWE-502) in Roundcube's redis and memcache session handlers. When PHP deserializes crafted session data supplied by an attacker, it can instantiate arbitrary PHP objects — specifically, the fix disables instantiation of GuzzleHttp\Cookie\FileCookieJar, a class whose destructor writes data to a file path controlled by the serialized object. This allows an unauthenticated network attacker to write arbitrary content to arbitrary file paths accessible by the web server process, requiring no user interaction or prior authentication. The vulnerability was reported by researcher "y0us" and patched by disabling dangerous class instantiation during deserialization in program/include/iniset.php (GitHub Commit, GitHub Commit).

Successful exploitation allows an unauthenticated remote attacker to write arbitrary files to the server filesystem with the permissions of the web server process. Depending on the server configuration, this could enable an attacker to write a PHP web shell to a web-accessible directory, leading to full remote code execution and system compromise. The integrity impact is rated High, with no direct confidentiality or availability impact from the deserialization itself, though post-exploitation activities could affect all three pillars (GitHub Advisory, Roundcube 1.7-rc5 Release).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is only exploitable on Roundcube instances configured to use redis or memcache as the session storage backend — the default file-based session handler is not affected. The EPSS score is approximately 0.03%, indicating a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify internet-facing Roundcube Webmail instances (versions before 1.5.14 or 1.6.0–1.6.13) using tools like Shodan or Censys. Confirm the instance is configured to use redis or memcache as the session handler (this may be inferred from server behavior or configuration exposure).
2. Craft malicious session data: Construct a PHP serialized payload that, when deserialized, instantiates GuzzleHttp\Cookie\FileCookieJar with attacker-controlled filename and storeSessionCookies properties. The destructor of this class writes cookie data to the specified file path.
3. Inject crafted session: Submit the malicious serialized payload as session data to the Roundcube application, targeting the redis or memcache session store. This can be done by directly writing to the session backend if accessible, or by exploiting the session handling endpoint.
4. Trigger deserialization: Initiate a request to Roundcube that causes the application to load and deserialize the crafted session data from the redis/memcache backend.
5. Achieve file write: The deserialization triggers the FileCookieJar destructor, writing attacker-controlled content (e.g., a PHP web shell) to a target path such as a web-accessible directory.
6. Execute code: Access the written web shell via HTTP to achieve remote code execution on the server (GitHub Commit, GitHub Advisory).

• Network: Unexpected or malformed session data submitted to Roundcube's session endpoints; anomalous connections from the web server to redis/memcache backends containing serialized PHP objects with GuzzleHttp class references.
• File System: Newly created PHP files (e.g., web shells) in web-accessible directories such as the Roundcube document root or upload directories; files with unusual ownership or timestamps matching the web server process.
• Logs: Web server access logs showing requests to newly created .php files not part of the standard Roundcube installation; PHP error logs referencing GuzzleHttp\Cookie\FileCookieJar deserialization or file write errors.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget) following access to suspicious PHP files.

Roundcube has released patched versions: 1.5.14 (for 1.5.x branch), 1.6.14 (for 1.6.x branch), and 1.7-rc5 (for the upcoming 1.7 branch), all released on March 18, 2026. The fix disables instantiation of GuzzleHttp\Cookie\FileCookieJar during PHP deserialization in program/include/iniset.php. Organizations should upgrade immediately, prioritizing instances using redis or memcache session handlers. As a temporary workaround, switching the session handler to the default file-based backend eliminates the attack surface; additionally, network segmentation restricting access to redis/memcache backends can reduce risk while patches are deployed (Roundcube 1.6.14 Release, Roundcube 1.5.14 Release, Roundcube 1.7-rc5 Release).

The vulnerability was discussed on the oss-security mailing list shortly after disclosure (oss-sec). Downstream Linux distributions including Debian and openSUSE issued security advisories and updated packages for their respective Roundcube packages. Red Hat also tracked the issue via Bugzilla (Red Hat Bugzilla). Community reaction on social platforms (Bluesky) was moderate, with security researchers noting the pre-authentication nature of the flaw as particularly concerning for internet-exposed deployments.