CVE-2026-75007 is an injection flaw (CWE-77) in Roundcube Webmail, where unescaped %u, %fu and %d values reach an LDAP search filter. The record rates it Medium at 5.4. Roundcube 1.6.18 and 1.7.3 fix it, so upgrade to one of them.
What's affected
The record says Roundcube Webmail before 1.6.18, and 1.7.x before 1.7.3, is affected. Roundcube's release announcement of 9 August 2026 lists both versions as security updates and credits Milan Hoppe for the LDAP report.
The issue appears only if you use LDAP address books or other LDAP lookups configured with a search filter that contains the %u, %fu or %d placeholders. Installations without LDAP are not in the path.
The same two releases fix several other issues, including a stored cross-site scripting bug, an IMAP command injection, a flaw in the markasjunk plugin and server-side request forgery filter bypasses, each with its own identifier. That alone is a reason to move to the new release instead of patching only this item.
How to check if you're exposed
Find your Roundcube version.
grep -n "RCMAIL_VERSION" program/include/iniset.php
The version is also shown in the About dialog of the web interface. Then check whether you use LDAP.
grep -rn "ldap" config/config.inc.php
grep -rn "search_filter" config/
If a search_filter contains %u, %fu or %d, the injection point exists. Packaged installs from a Linux distribution may carry backported fixes under a different version number, so check your distribution's security notice.
What to do now
- Upgrade to Roundcube 1.6.18 on the LTS line or 1.7.3 on the 1.7 line.
- Review your LDAP configuration and identify filters that use the substitution placeholders.
- Read the full list of fixes in the release announcement, and plan the upgrade as a package.
- Limit the LDAP account Roundcube uses to read only access to the attributes it needs.
- Check authentication and LDAP server logs for strange filter patterns.
Why it matters
The weakness is injection, CWE-77. LDAP search filters use special characters, and if a user name or domain is placed into the filter without escaping, the person supplying it can change what the filter matches. The record says this can lead to information disclosure or privilege escalation.
Webmail is a popular target, because it holds a large amount of personal and business mail and is often exposed to the internet. A moderate score for one flaw can still matter when it joins a set of related fixes in one release. The practical habit is to keep webmail within the supported releases and to run its directory lookups with limited rights. KEV status is false.
Quick check
Am I affected if I do not use LDAP?
The flaw concerns LDAP search filters. Without them, this issue does not apply, though the same release fixes other issues.
Which versions fix it?
Roundcube 1.6.18 and 1.7.3, according to the record and the release announcement.
Sources
Last reviewed: 18 October 2026.
