The vulnerability involves unsafe deserialization in the redis/memcache session handler of Roundcube Webmail. It allows unauthenticated attackers to craft session data that triggers arbitrary file write operations. This flaw is a form of deserialization vulnerability, identified as CWE-502, and can potentially be used to tamper with or overwrite files on the server, affecting the confidentiality, integrity, and availability of the application.

Roundcube Webmail versions prior to 1.5.14 and 1.6.14 are affected. The issue is tied to the use of redis or memcache for session storage in these releases.

The CVSS v3.1 score is 3.7, indicating low overall severity, but the lack of authentication requirement makes the risk higher in practice. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted session data to the webmail instance, which the redis/memcache handler deserializes and writes to disk without proper validation.