{"id":"CVE-2026-48844","aliases":["DEBIAN-CVE-2026-48844","EUVD-2026-31717","GHSA-qhxr-pc4x-jrq3","MGASA-2026-0194","UBUNTU-CVE-2026-48844","openSUSE-SU-2026:10869-1","openSUSE-SU-2026:20852-1"],"status":"published","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic...","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00414,"percentile":0.36011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670"],"published":"2026-05-25T19:14:48Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.16+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.16+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u9"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1+deb12u6","1.6.5+dfsg-1+deb12u7","1.6.5+dfsg-1+deb12u8","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-0+deb13u1","1.6.12+dfsg-1","1.6.13+dfsg-0+deb13u1","1.6.13+dfsg-1","1.6.14+dfsg-1","1.6.15+dfsg-0+deb13u1","1.6.15+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16+dfsg-1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-1","1.6.13+dfsg-1","1.6.14+dfsg-1","1.6.15+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4","1.2~beta+dfsg.1-0ubuntu1+esm5","1.2~beta+dfsg.1-0ubuntu1+esm6","1.2~beta+dfsg.1-0ubuntu1+esm7","1.2~beta+dfsg.1-0ubuntu1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3","1.3.6+dfsg.1-1ubuntu0.1~esm4","1.3.6+dfsg.1-1ubuntu0.1~esm5","1.3.6+dfsg.1-1ubuntu0.1~esm6","1.3.6+dfsg.1-1ubuntu0.1~esm7","1.3.6+dfsg.1-1ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3","1.4.3+dfsg.1-1ubuntu0.1~esm4","1.4.3+dfsg.1-1ubuntu0.1~esm5","1.4.3+dfsg.1-1ubuntu0.1~esm6","1.4.3+dfsg.1-1ubuntu0.1~esm7","1.4.3+dfsg.1-1ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4","1.5.0+dfsg.1-2ubuntu0.1~esm5","1.5.0+dfsg.1-2ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1","1.6.6+dfsg-2ubuntu0.1+esm2","1.6.6+dfsg-2ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.10+dfsg-1","1.6.10+dfsg-2","1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1","1.6.11+dfsg-1ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-2.1"}]}],"bundled":8}],"products":[{"vendor":"bulwarkmail","product":"webmail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.1","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862","tags":["fix","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.16","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48844","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qhxr-pc4x-jrq3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48844.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48844","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0194.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35599","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00212.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYFEOBDMYY7JRKWNFYSC7KT2TT2XXNBE/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/17","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-48844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48844","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48849","tags":["web"]},{"url":"https://bugzilla.suse.com/1266329","tags":["report"]},{"url":"https://bugzilla.suse.com/1266331","tags":["report"]},{"url":"https://bugzilla.suse.com/1266332","tags":["report"]},{"url":"https://bugzilla.suse.com/1266333","tags":["report"]},{"url":"https://bugzilla.suse.com/1266334","tags":["report"]},{"url":"https://bugzilla.suse.com/1266335","tags":["report"]},{"url":"https://bugzilla.suse.com/1266336","tags":["report"]},{"url":"https://bugzilla.suse.com/1266337","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-48844","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-25T19:14:48.753Z","modified":"2026-05-26T12:48:17.535Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-31717","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-25T19:14:48Z","modified":"2026-05-26T12:48:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:21:07.388987Z"}],"ghsa":[{"id":"GHSA-qhxr-pc4x-jrq3","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic...","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-26T13:30:49Z","modified":"2026-05-26T13:30:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:08:17.507995Z"}],"nvd":[{"id":"CVE-2026-48844","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-25T20:16:36.893Z","modified":"2026-07-24T10:10:00.197Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-48844","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-25T19:14:48.753Z","modified":"2026-11-11T10:47:30.437483786Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-670"],"updated_at":"2026-11-11T03:21:28.618498Z"},{"id":"DEBIAN-CVE-2026-48844","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-25T20:16:36.893Z","modified":"2026-10-01T03:03:16.294356202Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-48844","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)","status":"published","published":"2026-05-25T20:16:00Z","modified":"2026-10-17T13:00:24.341434875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"MGASA-2026-0194","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Multiple security vulnerabilities were discovered in RoundCube Webmail,\nwhich could result in cross-site scripting, SQL injection, SSRF bypass,\ninformation disclosure, denial of service or code injection.\n","status":"published","published":"2026-06-11T01:40:05Z","modified":"2026-06-11T01:45:04.73003894Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10869-1","title":"roundcubemail-1.6.16-2.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.16-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-05-28T08:15:08.854861512Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20852-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nChanges in roundcubemail:\n\n- update to 1.6.16\n  + Fix potential too long value in IMAP ID command (#10136)\n  + Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]\n  + Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName=\"style\"' [CVE-2026-48848] [bsc#1266336]\n  + Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]\n  + Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]\n  + Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]\n  + Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]\n  + Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]\n  + Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]\n","status":"published","published":"2026-05-31T10:25:53Z","modified":"2026-06-02T08:45:08.549316756Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}