CVE-2026-48844highCWE-670

CVE-2026-48844: falha de alta gravidade em Roundcube Webmail

Publicada em · Atualizada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
probabilidade de exploração
0.5%top 58% das CVEs
exploração observada
nãonenhuma fonte reporta
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Roundcube · Webmail
CVEs relacionadas — Roundcube Webmail

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49113CRITICALCVE-2025-49113EPSS 99.0%KEVCVE-2025-68461HIGHCVE-2025-68461EPSS 26.8%KEVCVE-2026-75002HIGHCVE-2026-75002EPSS 2.3%CVE-2026-74997HIGHCVE-2026-74997EPSS 1.1%CVE-2026-48842HIGHCVE-2026-48842EPSS 0.9%CVE-2026-35537LOWCVE-2026-35537EPSS 0.6%
Referências
https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5ahttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16https://github.com/roundcube/roundcubemail/releases/tag/1.7.1https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1