Vulnerability CVE-2026-113386: IMAP command injection in Roundcube in Plesk
CVE-2026-113386 is an IMAP command injection in the Roundcube Webmail shipped with Plesk for Linux: an authenticated webmail user can send specially crafted requests that make Roundcube run unintended IMAP commands. Plesk for Linux 18.0.81 through 18.0.81.4 are affected; the fix is Plesk Obsidian 18.0.81.5 or later, which includes Roundcube 1.6.20. Install the Plesk update from the panel (Tools & Settings → Update) — because exploitation needs a valid webmail login, exposure is limited to authenticated users, but on shared hosting every mailbox is a potential attacker account.
Команда обновления по умолчанию
plesk installer --select-release-current --update-installedЧто это значит по лицензии SharedLicense
Injected IMAP commands run inside the victim's mail session — a webmail user can potentially access or manipulate other users' mailbox operations through the injected session state, undermining the per-account isolation of shared mail services.
Situation
A security vulnerability was discovered in Roundcube Webmail, which is shipped with Plesk for Linux, that allows an authenticated user to inject IMAP commands. This security vulnerability has been identified as CVE-2026-113386.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| Plesk for Linux | 18.0.81 – 18.0.81.4 | 18.0.81.5 |
Impact
An authenticated webmail user can send specially crafted requests that make Roundcube run unintended IMAP commands. Exploitation requires a valid webmail login, so the risk is limited to authenticated users.
Call to action
Install Plesk updates to update Plesk Obsidian to 18.0.81.5 or later. This version includes Roundcube 1.6.20, which contains the fix.
Note: Do not install Roundcube packages from the operating system repositories or replace the Plesk-managed files with an upstream archive. Plesk ships and maintains its own Roundcube package, and manual replacement breaks the integration and future updates.
How to confirm the patched version is installed
Check the installed Plesk version as described in How to find version of Plesk installed on server? and make sure it is 18.0.81.5 or later.
Часто задаваемые вопросы
What is CVE-2026-113386?
Which Plesk versions are affected?
How do I apply the fix?
Who can exploit CVE-2026-113386?
Источники
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему