What is the CVSS score of EUVD-2026-18579?

EUVD-2026-18579 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-18579?

Yes, a patch is available for EUVD-2026-18579. Update the affected software to the latest version immediately.

Webmail EUVD-2026-18579

| CVE-2026-35538 LOW

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-04-03 mitre

GHSA-8jr8-v43g-5c57

CSRF Webmail

3.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 04:30 euvd

EUVD-2026-18579

Analysis Generated

Apr 03, 2026 - 04:30 vuln.today

CVE Published

Apr 03, 2026 - 03:35 nvd

LOW 3.1

DescriptionCVE.org

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

AnalysisAI

Roundcube Webmail before versions 1.5.14 and 1.6.14 allows authenticated remote attackers to conduct IMAP injection attacks or bypass CSRF protections via unsanitized IMAP SEARCH command arguments. The vulnerability requires user interaction (high complexity) and authenticated access, resulting in limited integrity impact without confidentiality or availability compromise. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Roundcube Webmail implements IMAP email search functionality by constructing IMAP SEARCH commands sent to backend mail servers. The vulnerability stems from insufficient sanitization of user-supplied search parameters before they are incorporated into IMAP protocol messages (CWE-88: Argument Injection). IMAP SEARCH commands use specific syntax with space and bracket delimiters; when user input is not properly escaped, attackers can inject arbitrary IMAP commands or protocol sequences. This also enables CSRF bypass because unsanitized parameters can be exploited in cross-site request scenarios where the user's authenticated session is leveraged without their knowledge. The affected product is Roundcube Webmail (cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*) across versions below 1.5.14 in the 1.5.x branch and versions 1.6.0 through 1.6.13 in the 1.6.x branch.

RemediationAI

Administrators must upgrade Roundcube Webmail to version 1.5.14 or later in the 1.5.x branch, or version 1.6.14 or later in the 1.6.x branch. Patched releases are available at https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 and https://github.com/roundcube/roundcubemail/releases/tag/1.6.14. The upstream fixes are documented in commits 7daf5aa9c190ccc75bb31672d8fee9938877fd64 (1.5.x), b18a8fa8e81571914c0ff55d4e20edb459c6952c (1.6.x), and 5fe8a69956a9683a4269f3ad2a68e18deebf8a15 (1.7-rc5). No interim workarounds are documented; patching is the primary remediation path. Users should test patched versions in a staging environment before production deployment to ensure mail search functionality remains operational.