← Back

CVE-2026-74997

nvd nist
Published: Aug 17, 2026Modified: Sep 8, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: MITRE (Secondary)

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

Affected (2)

Products: Roundcube: Webmail
Roundcube
1 product
Webmail
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Roundcube
Webmail
From 1.6.0 to 1.6.18
Webmail
From 1.7.0 to 1.7.3

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

Source: cve@mitre.org
Patch
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
Vendor Advisory

Timeline

No history available yet.