CVE-2026-48843
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient...
CVE-2026-48843 is a high vulnerability (CVSS 7.2) in Bulwarkmail Webmail, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u9.
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
CVE-2026-48843- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-31718
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
EUVD-2026-31718- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2hww-8583-w9wf
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient...
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
GHSA-2hww-8583-w9wf- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
CVE-2026-48843- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
CVE-2026-48843- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-48843
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
DEBIAN-CVE-2026-48843- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-48843
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
- Record
UBUNTU-CVE-2026-48843- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0194 No score
Updated roundcubemail packages fix security vulnerabilities
Multiple security vulnerabilities were discovered in RoundCube Webmail, which could result in cross-site scripting, SQL injection, SSRF bypass, information disclosure, denial of service or code injection.
- Record
MGASA-2026-0194- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10869-1 No score
roundcubemail-1.6.16-2.1 on GA media
These are all security issues fixed in the roundcubemail-1.6.16-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10869-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20852-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Changes in roundcubemail:
- update to 1.6.16
- Fix potential too long value in IMAP ID command (#10136)
- Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]
- Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336]
- Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]
- Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]
- Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]
- Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]
- Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]
- Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]
- Record
openSUSE-SU-2026:20852-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeDebian:12 |
before 1.6.5+dfsg-1+deb12u9, plus listed versions 1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2 Show 11 moreShow less1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1+deb12u81.6.5+dfsg-1~deb12u1 |
1.6.5+dfsg-1+deb12u9 |
roundcubeDebian:13 |
before 1.6.16+dfsg-0+deb13u1, plus listed versions 1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-0+deb13u11.6.15+dfsg-1 |
1.6.16+dfsg-0+deb13u1 |
roundcubeDebian:14 |
before 1.6.16+dfsg-1, plus listed versions 1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-1 |
1.6.16+dfsg-1 |
roundcubemailMageia:9 |
before 1.6.16-1.mga9 | 1.6.16-1.mga9 |
roundcubeUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1 Show 8 moreShow less1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8 |
None known |
roundcubeUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1 Show 8 moreShow less1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8 |
None known |
roundcubeUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2 Show 9 moreShow less1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8 |
None known |
roundcubeUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6 |
None known |
roundcubeUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2 Show 4 moreShow less1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3 |
None known |
roundcubeUbuntu:25.10 |
All versions, plus listed versions 1.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-1 |
None known |
roundcubeUbuntu:26.10 |
All versions, plus listed versions 1.6.11+dfsg-1 |
None known |
roundcubeUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1 |
None known |
roundcubemailopenSUSE:Tumbleweed |
before 1.6.16-2.1 | 1.6.16-2.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
github.com/roundcube/roundcubemail/releases/tag/1.7.1
nvd.nist.gov/vuln/detail/CVE-2026-48843
Show 26 moreShow less
security-tracker.debian.org/tracker/CVE-2026-48843
advisories.mageia.org/MGASA-2026-0194.html
bugs.mageia.org/show_bug.cgi?id=35599
lists.debian.org/debian-security-announce/2026/msg00212.html
lists.fedoraproject.org/archives/list/[email protected]/message/HYFEOBDMYY7JRKWNFYSC7KT2TT2XXNBE
openwall.com/lists/oss-security/2026/06/03/17
ubuntu.com/security/CVE-2026-48843
cve.org/CVERecord?id=CVE-2026-48843
suse.com/security/cve/CVE-2026-48842
bugzilla.suse.com/1266329