CVE-2026-48848
High · 7.2CVSS
7.2
EPSS
0.4%
Published
May 25, 2026
CISA due date
—
The record
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | roundcubemail | 0 | 1.6.16-2.1 |
Related vulnerabilities
- CVE-2026-48847 Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication… Also affects roundcubemail
- CVE-2026-48846 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image… Also affects roundcubemail
- CVE-2026-48845 In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image… Also affects roundcubemail
- CVE-2026-48849 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject… Also affects roundcubemail
- CVE-2026-48844 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation… Also affects roundcubemail
- CVE-2026-48843 Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient… Also affects roundcubemail
- CVE-2026-48842 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL… Also affects roundcubemail
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcubemail