Vulnerability CVE-2026-113386: IMAP command injection in Roundcube in Plesk

CVE-2026-113386 is an IMAP command injection in the Roundcube Webmail shipped with Plesk for Linux: an authenticated webmail user can send specially crafted requests that make Roundcube run unintended IMAP commands. Plesk for Linux 18.0.81 through 18.0.81.4 are affected; the fix is Plesk Obsidian 18.0.81.5 or later, which includes Roundcube 1.6.20. Install the Plesk update from the panel (Tools & Settings → Update) — because exploitation needs a valid webmail login, exposure is limited to authenticated users, but on shared hosting every mailbox is a potential attacker account.

High 7.1 CVSS 2026-10-20

Plesk

Standard-Update-Befehl

plesk installer --select-release-current --update-installed

Was das unter einer SharedLicense-Lizenz bedeutet

Injected IMAP commands run inside the victim's mail session — a webmail user can potentially access or manipulate other users' mailbox operations through the injected session state, undermining the per-account isolation of shared mail services.

Situation

A security vulnerability was discovered in Roundcube Webmail, which is shipped with Plesk for Linux, that allows an authenticated user to inject IMAP commands. This security vulnerability has been identified as CVE-2026-113386.

Affected product version

Product	Affected versions	Patched versions
Plesk for Linux	18.0.81 – 18.0.81.4	18.0.81.5

Impact

An authenticated webmail user can send specially crafted requests that make Roundcube run unintended IMAP commands. Exploitation requires a valid webmail login, so the risk is limited to authenticated users.

Call to action

Install Plesk updates to update Plesk Obsidian to 18.0.81.5 or later. This version includes Roundcube 1.6.20, which contains the fix.

Note: Do not install Roundcube packages from the operating system repositories or replace the Plesk-managed files with an upstream archive. Plesk ships and maintains its own Roundcube package, and manual replacement breaks the integration and future updates.

How to confirm the patched version is installed

Check the installed Plesk version as described in How to find version of Plesk installed on server? and make sure it is 18.0.81.5 or later.

Häufig gestellte Fragen

What is CVE-2026-113386?

It is an IMAP command injection vulnerability in Roundcube Webmail as shipped with Plesk for Linux: an authenticated user can craft requests that cause Roundcube to run unintended IMAP commands. Plesk identifies it as CVE-2026-113386 and rates the fix priority through the panel updater.

Which Plesk versions are affected?

Plesk for Linux 18.0.81 through 18.0.81.4. The patched version is 18.0.81.5 or later, which bundles Roundcube 1.6.20 — the same Roundcube security release DirectAdmin servers received through CustomBuild.

How do I apply the fix?

Install Plesk updates from the panel: Tools & Settings → Updates & Upgrades (or plesk installer --select-release-current --update-installed), which brings Obsidian to 18.0.81.5+ including the fixed Roundcube 1.6.20. Verify the Roundcube version in the Plesk webmail configuration afterwards.

Who can exploit CVE-2026-113386?

Only authenticated webmail users — a valid mail login is required to reach the injection point. On hosting servers that means any customer with a mailbox, so the update matters most on shared and reseller mail environments.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen