Roundcube Webmail contains a flaw in the rcube_session::unserialize routine that misinterprets session keys prefixed with an exclamation point. When such keys are present, the parser thinks the key has no value, causing the rest of the serialized input to be treated as part of a single, deserialized PHP object. This behavior provides an object injection primitive for an attacker who can influence the contents of a user session. The result is that malicious objects can be instantiated during session restoration, potentially leading to remote code execution depending on the autoload context. The vulnerability is categorized as CWE‑502 and carries a CVSS score of 7.4.

The flaw affects Roundcube Webmail versions before 1.6.20 and all 1.7.x releases earlier than 1.7.5. Users running these releases should verify their installed version and consider the vendor’s update path if they remain on an affected release.

The CVSS of 7.4 indicates a moderate‑to‑high severity. EPSS is not available and the issue has not yet been reported in CISA KEV, suggesting that, while theoretically exploitable, no documented exploitation is currently known. The likely attack vector is remote, through manipulation of session data such as setting a crafted cookie or modifying stored session files. If an attacker can influence the session string before it is unserialized, they can trigger arbitrary object creation and, with sufficient privileges, execute code on the server.