← back
CVE-2026-48849

CVE-2026-48849

CVSS 4.4 MEDIUMEPSS 0.2%CWE-79
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Roundcube · Webmail
public PoCs found — 1
githubgithub.com/AnandJogawade/CVE-2026-48849-Roundcube-Webmail-Stored-XSS★ 1
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/roundcube/roundcubemail/commit/189d30a4890319cd687df959ca9f768a3a613d61https://github.com/roundcube/roundcubemail/commit/a21519187873ce962db029b6ff68e47bd7f3fd8ahttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16https://github.com/roundcube/roundcubemail/releases/tag/1.7.1https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1