DeutschShown in its original language — a full translation is planned for a future version.
Roundcube Webmail: Mehrere Schwachstellen
view advisory published 2026-05-25
Ein Angreifer kann mehrere Schwachstellen in Roundcube Webmail ausnutzen, um SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-48849US | — | Exploit | ||
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mail… | ||||
| CVE-2026-48848US | — | — | ||
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has… | ||||
| CVE-2026-48847US | — | — | ||
Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass. | ||||
| CVE-2026-48846US | — | — | ||
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lea… | ||||
| CVE-2026-48845US | — | — | ||
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead t… | ||||
| CVE-2026-48844US | — | — | ||
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code e… | ||||
| CVE-2026-48843US | — | — | ||
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Info… | ||||
| CVE-2026-48842US | — | Exploit | ||
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass. | ||||
02
references
External citations — patches, advisories, analysis.
- Debian Security Advisory DLA-4604 vom 2026-05-28external
- Debian Security Advisory DLA-4693 vom 2026-07-22external
- Debian Security Advisory DLA-4760 vom 2026-08-29external
- Debian Security Advisory DSA-6301 vom 2026-05-28external
- openSUSE Security Update OPENSUSE-SU-2026:0183-1 vom 2026-06-12external
- openSUSE Security Update OPENSUSE-SU-2026:20852-1 vom 2026-06-01external
- Roundcube Security Updates 1.6.16 and 1.7.1 vom 2026-05-25external
- WID-SEC-W-2026-1671 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan