The vulnerability CVE-2026-35537 affects Roundcube Webmail prior to versions 1.5.14 and 1.6.14. It arises from unsafe deserialization of untrusted data within the redis/memcache session handler component. This unsafe deserialization can be exploited by unauthenticated attackers to write arbitrary files on the server by crafting malicious session data. The CVSS 3.1 base score is 3.7, reflecting a low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact confined to integrity loss without confidentiality or availability impact.

An unauthenticated attacker can exploit this vulnerability to write arbitrary files on the server hosting Roundcube Webmail. This could potentially lead to limited integrity violations. There is no direct impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor Roundcube's official channels for updates addressing this vulnerability. Until a fix is available, consider disabling or restricting use of the redis/memcache session handler if feasible to reduce exposure.