CVE-2026-35537+more: Roundcube arbitrary write + ID/XSS/etc. prior to 1.6.14

[Valtteri Vuorikoski <vuori () notcom org>]

Roundcube, a webmail frontend, released versions 1.5.14 and 1.6.14 on March 18
with fixes to a multitude of vulnerabilities. The 1.7 pre-releases are also
affected.

> From the release announcement <https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14>:

    * Fix pre-auth arbitrary file write via unsafe deserialization in
    redis/memcache session handler, reported by y0us.
    
    * Fix bug where a password could get changed without providing the old
    password, reported by flydragon777.
    
    * Fix IMAP Injection + CSRF bypass in mail search, reported by Martila
    Security Research Team.
    
    * Fix remote image blocking bypass via various SVG animate attributes,
    reported by nullcathedral.
    
    * Fix remote image blocking bypass via a crafted body background attribute,
    reported by nullcathedral.
    
    * Fix fixed position mitigation bypass via use of !important, reported by
    nullcathedral.
    
    * Fix XSS issue in a HTML attachment preview, reported by aikido_security.
    
    * Fix SSRF + Information Disclosure via stylesheet links to a local network
    hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at
    https://i0.rs/.

The file write is apparently CVE-2026-35537. Roundcube still does not provide
CVE numbers in their official announcements, interested parties can look them
up for the rest for example at the Debian security tracker
<https://security-tracker.debian.org/tracker/source-package/roundcube>.

 -Valtteri