CVE-2026-48844highCWE-670

CVE-2026-48844: high-severity vulnerability in Roundcube Webmail

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
exploitation probability
0.5%top 58% of all CVEs
observed exploitation
nono source reports it
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Roundcube · Webmail
Related CVEs — Roundcube Webmail

In the same product, most dangerous first.

CVE-2025-49113CRITICALCVE-2025-49113EPSS 99.0%KEVCVE-2025-68461HIGHCVE-2025-68461EPSS 26.8%KEVCVE-2026-75002HIGHCVE-2026-75002EPSS 2.3%CVE-2026-74997HIGHCVE-2026-74997EPSS 1.1%CVE-2026-48842HIGHCVE-2026-48842EPSS 0.9%CVE-2026-35537LOWCVE-2026-35537EPSS 0.6%
References
https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5ahttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16https://github.com/roundcube/roundcubemail/releases/tag/1.7.1https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1