CVE-2026-48844
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic...
CVE-2026-48844 is a high vulnerability (CVSS 7.5) in Bulwarkmail Webmail, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u9.
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
CVE-2026-48844- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-670
- Updated
- 2026-11-02
EUVDEUVD-2026-31717
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
EUVD-2026-31717- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qhxr-pc4x-jrq3
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic...
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
GHSA-qhxr-pc4x-jrq3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-670
- Updated
- 2026-11-02
NVD
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
CVE-2026-48844- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-670
- Updated
- 2026-11-02
OSV
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
CVE-2026-48844- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-670
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-48844
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
DEBIAN-CVE-2026-48844- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-48844
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
- Record
UBUNTU-CVE-2026-48844- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0194 No score
Updated roundcubemail packages fix security vulnerabilities
Multiple security vulnerabilities were discovered in RoundCube Webmail, which could result in cross-site scripting, SQL injection, SSRF bypass, information disclosure, denial of service or code injection.
- Record
MGASA-2026-0194- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10869-1 No score
roundcubemail-1.6.16-2.1 on GA media
These are all security issues fixed in the roundcubemail-1.6.16-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10869-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20852-1 No score
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Changes in roundcubemail:
- update to 1.6.16
- Fix potential too long value in IMAP ID command (#10136)
- Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]
- Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336]
- Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]
- Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]
- Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]
- Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]
- Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]
- Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]
- Record
openSUSE-SU-2026:20852-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeDebian:12 |
before 1.6.5+dfsg-1+deb12u9, plus listed versions 1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2 Show 11 moreShow less1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1+deb12u81.6.5+dfsg-1~deb12u1 |
1.6.5+dfsg-1+deb12u9 |
roundcubeDebian:13 |
before 1.6.16+dfsg-0+deb13u1, plus listed versions 1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-0+deb13u11.6.15+dfsg-1 |
1.6.16+dfsg-0+deb13u1 |
roundcubeDebian:14 |
before 1.6.16+dfsg-1, plus listed versions 1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-1 |
1.6.16+dfsg-1 |
roundcubemailMageia:9 |
before 1.6.16-1.mga9 | 1.6.16-1.mga9 |
roundcubeUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1 Show 8 moreShow less1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8 |
None known |
roundcubeUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1 Show 8 moreShow less1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8 |
None known |
roundcubeUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2 Show 9 moreShow less1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8 |
None known |
roundcubeUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6 |
None known |
roundcubeUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2 Show 4 moreShow less1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3 |
None known |
roundcubeUbuntu:25.10 |
All versions, plus listed versions 1.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-1 |
None known |
roundcubeUbuntu:26.10 |
All versions, plus listed versions 1.6.11+dfsg-1 |
None known |
roundcubeUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1 |
None known |
roundcubemailopenSUSE:Tumbleweed |
before 1.6.16-2.1 | 1.6.16-2.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
github.com/roundcube/roundcubemail/releases/tag/1.7.1
nvd.nist.gov/vuln/detail/CVE-2026-48844
Show 26 moreShow less
security-tracker.debian.org/tracker/CVE-2026-48844
advisories.mageia.org/MGASA-2026-0194.html
bugs.mageia.org/show_bug.cgi?id=35599
lists.debian.org/debian-security-announce/2026/msg00212.html
lists.fedoraproject.org/archives/list/[email protected]/message/HYFEOBDMYY7JRKWNFYSC7KT2TT2XXNBE
openwall.com/lists/oss-security/2026/06/03/17
ubuntu.com/security/CVE-2026-48844
cve.org/CVERecord?id=CVE-2026-48844
suse.com/security/cve/CVE-2026-48842
bugzilla.suse.com/1266329