Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allow an attacker to delete arbitrary files on the server before authenticating by poisoning session data stored in Redis or Memcache. The vulnerability is a result of insecure handling of session identifiers and the ability to write arbitrary paths to the session store, which can be exploited to remove critical files or disrupt service. The impact of this flaw includes permanent data loss or sabotage of the webmail service, compromising service availability and potentially resulting in loss of user data.

The affected software is Roundcube Webmail. Vulnerable revisions are 1.6.x preceding 1.6.16 and 1.7.x preceding 1.7.1. Administrators using Roundcube before these releases should verify the installed version against the official release notes.

The CVSS score of 3.7 classifies the risk as medium, but because the attack can be performed without authentication, the potential damage is significant. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Attackers can trigger the bug by manipulating session data via Redis or Memcache, which suggests that the attack vector is network‑based session poisoning. The vulnerability requires no special privileges to initiate and can be executed by an unauthenticated actor who can influence the session store.