Roundcube Webmail CVE-2026-74997

Exploitation requires all of the following: (1) a valid authenticated Roundcube user account (CVSS PR:L - standard email login, no administrator rights required); (2) the markasjunk plugin must be installed and enabled on the target Roundcube instance; (3) the markasjunk plugin must be explicitly configured to use the cmd_learn driver specifically - not any other available driver. The CVE description states unambiguously: 'This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver,' confirming this as a non-default operator configuration. The attacker triggers exploitation by marking a crafted message as spam/junk through the standard UI. Factors that limit exploitation: authentication is required (no unauthenticated exploitation path), the cmd_learn driver configuration is non-default and must be deliberately enabled by an administrator, and exploitation is confined to the web server process privilege level (no kernel or root escalation implied by the vulnerability itself).

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8, reflecting a network-reachable exploit requiring only a low-privilege authenticated session with no interaction from other users and full confidentiality, integrity, and availability impact. The PR:L rating is accurate: a standard Roundcube user account is sufficient to trigger the vulnerable spam-marking workflow. However, the decisive limiting factor is the non-default prerequisite: the markasjunk plugin must be installed AND explicitly configured to use the cmd_learn driver. Deployments using alternative drivers or no markasjunk plugin are fully unaffected. No EPSS score was provided in the available data. The CVE is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at time of analysis. Real-world priority should be treated as HIGH for the subset of Roundcube instances running markasjunk with cmd_learn, but substantially reduced for the broader Roundcube deployment base where this specific configuration is absent. The absence of KEV listing and public PoC is consistent with a narrowly scoped vulnerability reported through responsible disclosure.

An attacker with a valid Roundcube user account crafts or receives an email containing shell metacharacters in a field consumed as a cmd_learn placeholder replacement value, then marks the message as junk, causing the markasjunk plugin to invoke the cmd_learn driver; the unsanitized placeholder is expanded into the OS command string and interpreted by the shell, executing arbitrary commands under the web server process's privileges. No public proof-of-concept has been identified, but CWE-78 command injection is a well-understood and reliably exploitable class once the injection point and placeholder variable names are identified through source code review.