Roundcube Webmail contains an unsafe deserialization flaw in its Redis/Memcache session handler. When a crafted session payload is deserialized, the attacker can trigger arbitrary file write operations on the server. This allows overwrite or creation of files, potentially enabling the deployment of malicious scripts or the modification of configuration files.

The vulnerability affects all Roundcube Webmail installations running versions prior to 1.5.14 or 1.6.14 that use the Redis or Memcache session handling modules. Any deployment employing those session stores is susceptible.

The flaw carries a CVSS score of 3.7, indicating moderate severity, and an EPSS score of less than 1 %, suggesting low likelihood of widespread exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can execute the flaw without authentication by supplying a maliciously crafted session payload, granting the ability to write files wherever the webmail process has write permission.