CVE-2026-48849

mediumpriority · track · 10EPSS 0.002 · 15 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.24% (15th) EPSS

CVSS 4.4 · medium

Is it mine?

11 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

cvss

Technical severity, 0–10. One row per scoring source.

4.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.4mediumAV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.14.4mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.14.4mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · cve@mitre.org USexploitability 1.3 · impact 2.7

v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

exploits (1)

Public proof-of-concept and weaponised exploit code.

AnandJogawade/CVE-2026-48849-Roundcube-Webmail-Stored-XSSThis repository documents CVE-2026-48849, a Stored Cross-Site Scripting (XSS), HTML Injection, and CSS Injection vulnerability discovered in Roundcube WebmaiPoC · poc_in_github

affected products (11)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source Roundcube< 1.6.16cert_bundDE
Open Source Roundcube< 1.7.1cert_bundDE
Roundcube Webmail1.6.0 → 1.6.16enisa_euvdEU
Roundcube Webmail1.7.0 → 1.7.1enisa_euvdEU
The RoundCube Team RoundCube Webmail1.6 → 1.6.16fstec_bduRU
The RoundCube Team RoundCube Webmail1.7 → 1.7.1fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 13fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1671Roundcube Webmail: Mehrere SchwachstellenDeutsch2026-05-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Roundcube Webmail ausnutzen, um SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2026-05-25modified 2026-07-24

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan