CVE-2026-48849

🗓️ 25 May 2026 19:30:38Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 198 Views🌐 WEB

CVE-2026-48849: Unsanitized draft subject in Roundcube Webmail could cause stored cross site scripting on shared mailboxes.

Reporter	Title	Published	Views	Family All 34
ATTACKERKB	CVE-2026-48849	25 May 202619:30	–	attackerkb
Information Security Automation	June Linux Patch Wednesday	26 Jun 202617:00	–	avleonov
BDU FSTEC	The vulnerability of the RoundCube Webmail email client, related to the lack of protection for the website structure, allows attackers to perform cross-site scripting attacks (XSS).	2 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-48849	13 Jul 202622:00	–	circl
CNNVD	Roundcube Webmail 跨站脚本漏洞	25 May 202600:00	–	cnnvd
Cvelist	CVE-2026-48849	25 May 202619:30	–	cvelist
Debian	[SECURITY] [DLA 4604-1] roundcube security update	28 May 202613:18	–	debian
Debian	[SECURITY] [DSA 6301-1] roundcube security update	27 May 202621:01	–	debian
Debian CVE	CVE-2026-48849	25 May 202619:30	–	debiancve
Tenable Nessus	Debian dla-4604 : roundcube - security update	28 May 202600:00	–	nessus

Vulners

CNA

Node

roundcube webmailRange1.6.0–1.6.16

roundcube webmailRange1.7.0–1.7.1

[
  {
    "defaultStatus": "unaffected",
    "product": "Webmail",
    "vendor": "Roundcube",
    "versions": [
      {
        "lessThan": "1.6.16",
        "status": "affected",
        "version": "1.6.0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.7.1",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/roundcube/roundcubemail/commit/a21519187873ce962db029b6ff68e47bd7f3fd8a
roundcube	www.roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
github	www.github.com/roundcube/roundcubemail/releases/tag/1.6.16
github	www.github.com/roundcube/roundcubemail/releases/tag/1.7.1
github	www.github.com/roundcube/roundcubemail/commit/189d30a4890319cd687df959ca9f768a3a613d61

Parameter	Position	Path	Description	CWE
subject	binary	/poc/CVE-2026-48849.mp4	Stored XSS/HTML/CSS injection in Roundcube Webmail via unsanitized subject in draft/session restoration data.	CWE-79

17 Jun 2026 10:55Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.4

EPSS0.00239

SSVC

CWE-79