CVE-2026-48849
Medium · 4.4CVSS
4.4
EPSS
0.3%
Published
May 25, 2026
CISA due date
—
The record
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | roundcubemail | 0 | 1.6.16-2.1 |
Related vulnerabilities
- CVE-2026-48847 Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication… Also affects roundcubemail
- CVE-2026-48846 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image… Also affects roundcubemail
- CVE-2026-48845 In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image… Also affects roundcubemail
- CVE-2026-48848 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML… Also affects roundcubemail
- CVE-2026-48844 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation… Also affects roundcubemail
- CVE-2026-48843 Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient… Also affects roundcubemail
- CVE-2026-48842 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL… Also affects roundcubemail
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcubemail