CVE-2026-48842

🗓️ 25 May 2026 19:06:37Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 63 Views

Roundcube Webmail has pre-auth SQL injection in the virtuser_query plugin via a preg_replace escape bypass.

Reporter	Title	Published	Views	Family All 24
ATTACKERKB	CVE-2026-48842	25 May 202619:06	–	attackerkb
Circl	CVE-2026-48842	26 May 202606:30	–	circl
CNNVD	Roundcube Webmail SQL注入漏洞	25 May 202600:00	–	cnnvd
Cvelist	CVE-2026-48842	25 May 202619:06	–	cvelist
Debian	[SECURITY] [DLA 4604-1] roundcube security update	28 May 202613:18	–	debian
Debian	[SECURITY] [DSA 6301-1] roundcube security update	27 May 202621:01	–	debian
Debian CVE	CVE-2026-48842	25 May 202619:06	–	debiancve
Tenable Nessus	Debian dla-4604 : roundcube - security update	28 May 202600:00	–	nessus
Tenable Nessus	Debian dsa-6301 : roundcube - security update	28 May 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : roundcubemail (openSUSE-SU-2026:20852-1)	2 Jun 202600:00	–	nessus

Vulners

CNA

Node

roundcube webmailRange1.6.0–1.6.16

roundcube webmailRange1.7.0–1.7.1

[
  {
    "defaultStatus": "unaffected",
    "product": "Webmail",
    "vendor": "Roundcube",
    "versions": [
      {
        "lessThan": "1.6.16",
        "status": "affected",
        "version": "1.6.0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.7.1",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9
roundcube	www.roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
github	www.github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b
github	www.github.com/roundcube/roundcubemail/releases/tag/1.6.16
github	www.github.com/roundcube/roundcubemail/releases/tag/1.7.1

26 May 2026 19:26Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

EPSS0.00105

SSVC

CWE-89