Situation
A security vulnerability was discovered in Roundcube Webmail, which is shipped with Plesk for Linux, that allows an authenticated user to inject IMAP commands. This security vulnerability has been identified as CVE-2026-113386.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| Plesk for Linux | 18.0.81 - 18.0.81.4 | 18.0.81.5 |
Impact
An authenticated webmail user can send specially crafted requests that make Roundcube run unintended IMAP commands. Exploitation requires a valid webmail login, so the risk is limited to authenticated users.
Call to action
Install Plesk updates to update Plesk Obsidian to 18.0.81.5 or later. This version includes Roundcube 1.6.20, which contains the fix.
Note: Do not install Roundcube packages from the operating system repositories or replace the Plesk-managed files with an upstream archive. Plesk ships and maintains its own Roundcube package, and manual replacement breaks the integration and future updates.
How to confirm the patched version is installed
Check the installed Plesk version as described in How to find version of Plesk installed on server? and make sure it is 18.0.81.5 or later.
Comments
Please sign in to leave a comment.