PT-2026-43106 · Unknown · Roundcube Webmail

Zazy · Published 2026-05-24 · Updated 2026-05-27 · CVE-2026-48843

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.14 through 1.6.16 Roundcube Webmail versions prior to 1.7.1

Description Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to Server-Side Request Forgery (SSRF), where an attacker induces the server to make requests to an unintended location, or Information Disclosure. This occurs if stylesheet links point to local network hosts.

Recommendations Update to version 1.6.16-2.1 for versions 1.6.14 through 1.6.16. Update to version 1.7.1 for versions prior to 1.7.1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-07449

CVE-2026-48843

OPENSUSE-SU-2026:10869-1

OPENSUSE-SU-2026:20852-1

Affected Products

Roundcube Webmail

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48843.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48843 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48843 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48843 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48843 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48843 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48843 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07449 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10869-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48843 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 · Note
• https://github.com/roundcube/roundcubemail/commit/cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1 · Note
• https://github.com/roundcube/roundcubemail/commit/ab96c88bfd888866ec5e02190b19618db283923a · Note
• https://suse.com/security/cve/CVE-2026-48844 · Note