Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a vulnerability in the rcube_session::unserialize() function. This flaw allows an attacker who can influence stored session data to perform PHP object injection by exploiting how session keys prefixed with “!” are handled. The issue was fixed by rejecting such keys in a subsequent update.