{"id":"CVE-2026-48848","aliases":["DEBIAN-CVE-2026-48848","EUVD-2026-31727","GHSA-p64r-9rcj-x33x","MGASA-2026-0194","UBUNTU-CVE-2026-48848","openSUSE-SU-2026:10869-1","openSUSE-SU-2026:20852-1"],"status":"published","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization...","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00388,"percentile":0.33322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-25T19:27:54Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.16+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.16+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u9"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1+deb12u6","1.6.5+dfsg-1+deb12u7","1.6.5+dfsg-1+deb12u8","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-0+deb13u1","1.6.12+dfsg-1","1.6.13+dfsg-0+deb13u1","1.6.13+dfsg-1","1.6.14+dfsg-1","1.6.15+dfsg-0+deb13u1","1.6.15+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16+dfsg-1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-1","1.6.13+dfsg-1","1.6.14+dfsg-1","1.6.15+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4","1.2~beta+dfsg.1-0ubuntu1+esm5","1.2~beta+dfsg.1-0ubuntu1+esm6","1.2~beta+dfsg.1-0ubuntu1+esm7","1.2~beta+dfsg.1-0ubuntu1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3","1.3.6+dfsg.1-1ubuntu0.1~esm4","1.3.6+dfsg.1-1ubuntu0.1~esm5","1.3.6+dfsg.1-1ubuntu0.1~esm6","1.3.6+dfsg.1-1ubuntu0.1~esm7","1.3.6+dfsg.1-1ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3","1.4.3+dfsg.1-1ubuntu0.1~esm4","1.4.3+dfsg.1-1ubuntu0.1~esm5","1.4.3+dfsg.1-1ubuntu0.1~esm6","1.4.3+dfsg.1-1ubuntu0.1~esm7","1.4.3+dfsg.1-1ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4","1.5.0+dfsg.1-2ubuntu0.1~esm5","1.5.0+dfsg.1-2ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1","1.6.6+dfsg-2ubuntu0.1+esm2","1.6.6+dfsg-2ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.10+dfsg-1","1.6.10+dfsg-2","1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1","1.6.11+dfsg-1ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-2.1"}]}],"bundled":8}],"products":[{"vendor":"bulwarkmail","product":"webmail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.1","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9","tags":["fix","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.16","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48848","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p64r-9rcj-x33x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48848.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48848","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0194.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35599","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00212.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYFEOBDMYY7JRKWNFYSC7KT2TT2XXNBE/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/17","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-48848","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48848","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48849","tags":["web"]},{"url":"https://bugzilla.suse.com/1266329","tags":["report"]},{"url":"https://bugzilla.suse.com/1266331","tags":["report"]},{"url":"https://bugzilla.suse.com/1266332","tags":["report"]},{"url":"https://bugzilla.suse.com/1266333","tags":["report"]},{"url":"https://bugzilla.suse.com/1266334","tags":["report"]},{"url":"https://bugzilla.suse.com/1266335","tags":["report"]},{"url":"https://bugzilla.suse.com/1266336","tags":["report"]},{"url":"https://bugzilla.suse.com/1266337","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-48848","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-25T19:27:54.841Z","modified":"2026-05-26T13:00:52.631Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-31727","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-25T19:27:54Z","modified":"2026-05-26T13:00:52Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:21:07.388987Z"}],"ghsa":[{"id":"GHSA-p64r-9rcj-x33x","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization...","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-26T13:30:49Z","modified":"2026-05-26T13:30:50Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:08:17.507995Z"}],"nvd":[{"id":"CVE-2026-48848","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-25T20:16:37.413Z","modified":"2026-07-24T10:10:00.197Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-48848","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-25T19:27:54.841Z","modified":"2026-10-28T02:30:40.754756772Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"DEBIAN-CVE-2026-48848","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-25T20:16:37.413Z","modified":"2026-10-01T03:03:07.697254041Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-48848","description":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.","status":"published","published":"2026-05-25T20:16:00Z","modified":"2026-10-17T13:00:23.557639869Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"MGASA-2026-0194","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Multiple security vulnerabilities were discovered in RoundCube Webmail,\nwhich could result in cross-site scripting, SQL injection, SSRF bypass,\ninformation disclosure, denial of service or code injection.\n","status":"published","published":"2026-06-11T01:40:05Z","modified":"2026-06-11T01:45:04.73003894Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10869-1","title":"roundcubemail-1.6.16-2.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.16-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-05-28T08:15:08.854861512Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20852-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nChanges in roundcubemail:\n\n- update to 1.6.16\n  + Fix potential too long value in IMAP ID command (#10136)\n  + Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]\n  + Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName=\"style\"' [CVE-2026-48848] [bsc#1266336]\n  + Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]\n  + Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]\n  + Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]\n  + Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]\n  + Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]\n  + Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]\n","status":"published","published":"2026-05-31T10:25:53Z","modified":"2026-06-02T08:45:08.549316756Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}