CVE-2026-113386 | Roundcube Webmail up to 1.6.19/1.7.4 _uid command injection

October 20, 2026 Yanac

A vulnerability classified as critical was found in Roundcube Webmail up to 1.6.19/1.7.4. The impacted element is an unknown function. Such manipulation of the argument _uid leads to command injection.

This vulnerability is referenced as CVE-2026-113386. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More