Unknown · Roundcube Webmail · CVE-2026-48842
**Name of the Vulnerable Software and Affected Versions**
Roundcube Webmail versions 1.6.x prior to 1.6.16
Roundcube Webmail versions 1.7.x prior to 1.7.1
**Description**
A pre-authentication SQL injection exists in the `virtuser query` plugin. The issue stems from a backslash escape bypass within the `preg replace()` function, which fails to properly protect the SQL query structure. This allows a remote attacker to impact the confidentiality, integrity, and availability of the protected information.
**Recommendations**
Update to version 1.6.16 for versions 1.6.x.
Update to version 1.7.1 for versions 1.7.x.