PT-2026-43105 · Unknown+1 · Roundcube Webmail+1

Zazy · CVE-2026-48842 · Published 2026-05-24 · Updated 2026-06-28

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x prior to 1.6.16 Roundcube Webmail versions 1.7.x prior to 1.7.1

Description A pre-authentication SQL injection exists in the virtuser query plugin. The issue stems from a backslash escape bypass within the preg replace() function, which fails to properly protect the SQL query structure. This allows a remote attacker to impact the confidentiality, integrity, and availability of the protected information.

Recommendations Update to version 1.6.16 for versions 1.6.x. Update to version 1.7.1 for versions 1.7.x.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-07447

CVE-2026-48842

OPENSUSE-SU-2026:10869-1

OPENSUSE-SU-2026:20852-1

Affected Products

Roundcube Webmail

Virtuser Query

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48842.json · Exploit
• https://ubuntu.com/security/CVE-2026-48842 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48842 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48842 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48842 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-48842 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48842 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48842 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07447 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10869-1 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 · Note
• https://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9 · Note
• https://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b · Note
• https://twitter.com/lyrie_ai/status/2063867678125609008 · Twitter Post