CVE-2026-35538 | Roundcube Webmail up to 1.5.13/1.6.13 IMAP SEARCH Command Argument argument injection

A vulnerability classified as critical has been found in Roundcube Webmail up to 1.5.13/1.6.13. This impacts an unknown function of the component IMAP SEARCH Command Argument Handler. The manipulation leads to argument injection.

This vulnerability is uniquely identified as CVE-2026-35538. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.