Roundcube Webmail: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• High 8.1
  CVE-2026-48842 Public exploit

  Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query…

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• High 7.5
  CVE-2026-48844

  Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues …

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• High 7.2
  CVE-2026-48843

  Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) …

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• High 7.2
  CVE-2026-48848

  Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascad…

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• Medium 6.5
  CVE-2026-48845

  In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for …

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• Medium 6.5
  CVE-2026-48846

  In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via …

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• Medium 4.4
  CVE-2026-48849 Public exploit

  In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored val…

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026
• Low 3.7
  CVE-2026-48847

  Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via red…

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  May 25, 2026

Revision history

1. 2026-10-05 #9

   Neue Updates von Debian aufgenommen

2. 2026-09-24 #8

   CVE-2026-48842 wird ausgenutzt

3. 2026-08-30 #7

   Neue Updates von Debian aufgenommen

4. 2026-07-21 #6

   Neue Updates von Debian aufgenommen

5. 2026-06-11 #5

   Neue Updates von openSUSE aufgenommen

6. 2026-06-01 #4

   Neue Updates von openSUSE aufgenommen

7. 2026-05-28 #3

   Neue Updates von Debian aufgenommen

8. 2026-05-27 #2

   Neue Updates von Debian aufgenommen

9. 2026-05-25 #1

   Initiale Fassung

References

• Roundcube Security Updates 1.6.16 and 1.7.1 vom 2026-05-25
  https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
• Debian Security Advisory DSA-6301 vom 2026-05-28
  https://lists.debian.org/debian-security-announce/2026/msg00212.html
• Debian Security Advisory DLA-4604 vom 2026-05-28
  https://lists.debian.org/debian-lts-announce/2026/05/msg00048.html
• openSUSE Security Update OPENSUSE-SU-2026:20852-1 vom 2026-06-01
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SUT5CRAE4EHJ5ORBEGHIIIFTAFAEE7EZ/
• openSUSE Security Update OPENSUSE-SU-2026:0183-1 vom 2026-06-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/52P6YFZNXXVCMYRXBZLCVQUAZ7QNLAXW/
• Debian Security Advisory DLA-4693 vom 2026-07-22
  https://lists.debian.org/debian-lts-announce/2026/07/msg00035.html
• Debian Security Advisory DLA-4760 vom 2026-08-29
  https://lists.debian.org/debian-lts-announce/2026/08/msg00051.html
• Canadian Centre for Cyber Security Advisory AV26-503 vom 2026-09-24
  https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503
• Debian Security Advisory DLA-4823 vom 2026-10-05
  https://lists.debian.org/debian-lts-announce/2026/10/msg00015.html