Stored XSS Vulnerability in Roundcube Webmail Software
CVE-2026-48849

4.4MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
25 May 2026

What is CVE-2026-48849?

In Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1, a vulnerability exists due to an unsanitized subject field within the draft restore functionality. This flaw can potentially allow attackers to inject malicious HTML or CSS code into shared mailboxes, leading to stored cross-site scripting (XSS) attacks. This could enable unauthorized scripts to be executed by users accessing the compromised mailbox, thereby compromising user data and security.

Affected Version(s)

Webmail 1.6.0 < 1.6.16

Webmail 1.7.0 < 1.7.1

References

https://roundcube.net/news/2026/05/24/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/189d30a...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.