Every CVE Search/ Get API key

CVE-2026-48846

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking...

6.5 MediumFix available

CVE-2026-48846 is a medium vulnerability (CVSS 6.5) in Bulwarkmail Webmail, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u9.

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.40%Up 0.4 points since May 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
CVE-2026-48846
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-669
Updated
2026-11-02
EUVDEUVD-2026-31725 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
EUVD-2026-31725
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xx87-33v7-6x23 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking...

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
GHSA-xx87-33v7-6x23
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-669
Updated
2026-11-02
NVD 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
CVE-2026-48846
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-669
Updated
2026-11-02
OSV 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
CVE-2026-48846
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-669
Updated
2026-11-02
OSVDEBIAN-CVE-2026-48846 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
DEBIAN-CVE-2026-48846
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-48846 6.5

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Record
UBUNTU-CVE-2026-48846
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2026-0194 No score

Updated roundcubemail packages fix security vulnerabilities

Multiple security vulnerabilities were discovered in RoundCube Webmail, which could result in cross-site scripting, SQL injection, SSRF bypass, information disclosure, denial of service or code injection.

Record
MGASA-2026-0194
Updated
2026-11-02
OSVopenSUSE-SU-2026:10869-1 No score

roundcubemail-1.6.16-2.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.16-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10869-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20852-1 No score

Security update for roundcubemail

This update for roundcubemail fixes the following issues:

Changes in roundcubemail:

  • update to 1.6.16
    • Fix potential too long value in IMAP ID command (#10136)
    • Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]
    • Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336]
    • Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]
    • Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]
    • Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]
    • Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]
    • Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]
    • Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]
Record
openSUSE-SU-2026:20852-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Debian:12
 before 1.6.5+dfsg-1+deb12u9, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 11 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1+deb12u81.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u9
roundcube
Debian:13
 before 1.6.16+dfsg-0+deb13u1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-0+deb13u11.6.15+dfsg-1
1.6.16+dfsg-0+deb13u1
roundcube
Debian:14
 before 1.6.16+dfsg-1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-1
1.6.16+dfsg-1
roundcubemail
Mageia:9
 before 1.6.16-1.mga9
1.6.16-1.mga9
roundcube
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1
Show 8 moreShow less
1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8
 None known
roundcube
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1
Show 8 moreShow less
1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2
Show 9 moreShow less
1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6
 None known
roundcube
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2
Show 4 moreShow less
1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3
 None known
roundcube
Ubuntu:25.10
 All versions, plus listed versions
1.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-1
 None known
roundcube
Ubuntu:26.10
 All versions, plus listed versions
1.6.11+dfsg-1
 None known
roundcube
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1
 None known
roundcubemail
openSUSE:Tumbleweed
 before 1.6.16-2.1
1.6.16-2.1

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open