EUVD-2026-31724
GHSA-9vwp-h229-h4cm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.
AnalysisAI
Pre-authentication arbitrary file deletion in Roundcube Webmail 1.6.x (before 1.6.16) and 1.7.x (before 1.7.1) is achievable by unauthenticated network attackers via session poisoning of Redis or Memcache storage backends. The root cause (CWE-669: Incorrect Resource Transfer Between Spheres) lies in the application improperly trusting session data read from an external cache tier, allowing crafted entries to bypass pre-authentication controls and trigger file deletion operations. No public exploit has been identified at time of analysis, and EPSS stands at 0.06%, though Roundcube installations are historically targeted by espionage-motivated threat actors and patching is strongly recommended.
Technical ContextAI
Roundcube Webmail optionally supports Redis and Memcache as distributed session storage backends in place of the default file or database session handlers. CWE-669 (Incorrect Resource Transfer Between Spheres) describes a failure to enforce trust boundaries when data moves from an external storage sphere - here, the Redis/Memcache tier - into the application's authentication and session-handling sphere. An attacker who can write a crafted payload into the cache store can cause Roundcube to deserialize or interpret that session object before authentication is established, using it to manipulate internal file operation logic. The GitHub commit references (a4eb375b and 703318e6) represent the authoritative source-code fixes for both the 1.7.x and 1.6.x branches respectively. The affected CPE is cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*, covering all platform/architecture variants of the PHP-based webmail application.
RemediationAI
Upgrade to Roundcube Webmail 1.6.16 or 1.7.1 immediately, as confirmed by the vendor security announcement at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1, with GitHub release artifacts at https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.1. The vendor recommends backing up data before upgrading. As a compensating control where immediate patching is not possible, switch session storage from Redis or Memcache to the database or file-based backend (configured via $config['session_storage'] in Roundcube's config), which removes the vulnerable code path entirely - though this may introduce performance trade-offs for large deployments. Additionally, restrict Redis and Memcache ports (default 6379 and 11211) to only the Roundcube application server via firewall rules, and enable authentication on the Redis instance (requirepass directive) to reduce the attacker's ability to write poisoned session data. Note that network restriction alone does not patch the vulnerability if the attacker has already achieved a foothold on the application server.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today