CVE-2026-35538: 
PHP vulnerability analysis and mitigation

CVE-2026-35538 is an IMAP injection and CSRF bypass vulnerability in Roundcube Webmail affecting versions before 1.5.14 and 1.6.0 through 1.6.13. Unsanitized IMAP SEARCH command arguments allow authenticated attackers to inject extra IMAP commands or bypass CSRF protections during mail search operations. The vulnerability was reported by the Martila Security Research Team and patched on March 18, 2026, with public disclosure on April 3, 2026. It carries a CVSS v3.1 base score of 3.1 (Low) (GitHub Advisory, Roundcube).

The root cause is improper neutralization of argument delimiters in IMAP SEARCH command inputs (CWE-88). In program/actions/mail/search.php, the $search_str (filter) and $message_id variables were passed directly into IMAP SEARCH commands without stripping newline characters (\r or \n). An attacker could embed newline sequences in these parameters to inject additional IMAP commands or manipulate CSRF token validation during mail search. The fix applies preg_replace('/[\r\n]+/', ' ', ...) to sanitize these inputs before they reach the IMAP layer (Roundcube Commit, Roundcube Commit).

Successful exploitation is limited in scope: a low-privileged authenticated user could manipulate IMAP SEARCH command behavior or bypass CSRF protections during mail search operations, resulting in a low integrity impact with no confidentiality or availability impact. There is no evidence of data exfiltration, remote code execution, or lateral movement potential associated with this vulnerability. The practical impact is confined to unauthorized modification of mail search behavior on the affected Roundcube instance (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability requires low-level authenticated access and has high attack complexity, limiting its practical exploitability. The EPSS score is approximately 0.036%, reflecting a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authentication: Log in to a vulnerable Roundcube Webmail instance (version < 1.5.14 or 1.6.0–1.6.13) with valid user credentials.
2. Identify the mail search endpoint: Navigate to the mail search functionality, which triggers requests to program/actions/mail/search.php.
3. Craft a malicious search filter: Inject a newline character (\r\n) into the search filter or message ID parameter to break out of the intended IMAP SEARCH command context. For example, embed a payload such as ALL\r\nUID FETCH 1:* (BODY[]) in the search string.
4. Submit the request: Send the crafted search request to the server. The unsanitized input is passed directly into the IMAP SEARCH command, causing the IMAP server to interpret the injected content as a separate command.
5. CSRF bypass (alternative path): Craft a request that leverages the unsanitized parameter to bypass CSRF token validation during the search operation, potentially enabling cross-site request forgery attacks against authenticated users (Roundcube Commit).

• Network: Unusual or malformed IMAP SEARCH commands observed in IMAP server logs containing embedded newline sequences (\r\n) or unexpected command sequences following a SEARCH command.
• Logs: Roundcube application logs showing search requests with URL-encoded or raw newline characters (%0d, %0a, \r, \n) in the _search or _message_id POST parameters; anomalous IMAP session activity such as unexpected UID FETCH or SELECT commands immediately following a SEARCH command.
• Application: Unexpected IMAP mailbox access patterns or search results inconsistent with the user's submitted query, potentially indicating injected IMAP commands were executed.

Roundcube has released patched versions addressing this vulnerability: upgrade to 1.5.14 (for 1.5.x installations), 1.6.14 (for 1.6.x installations), or 1.7-rc5 or later (for 1.7 branch). No configuration-based workaround is available; upgrading is the only remediation. Administrators should back up data before updating and use the provided installto.sh or update.sh migration scripts as appropriate (Roundcube, 1.6.14 Release, 1.5.14 Release).

The vulnerability was reported by the Martila Security Research Team and acknowledged by Roundcube maintainer Aleksander Machniak in the official release notes for versions 1.5.14, 1.6.14, and 1.7-rc5 (1.6.14 Release). Downstream Linux distributions including Debian and Fedora issued security advisories and package updates following the upstream patch release. Community reaction has been measured given the low CVSS score and absence of public exploits.