PT-2026-43107 · Unknown · Roundcube Webmail

Zazy · CVE-2026-48844 · Published 2026-05-24 · Updated 2026-05-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x through 1.6.15 Roundcube Webmail versions 1.7.x through 1.7.0

Description Insecure code evaluation logic exists within the LDAP autovalues option, which could lead to code injection.

Recommendations Update to version 1.6.16 for the 1.6.x branch. Update to version 1.7.1 for the 1.7.x branch.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

BDU:2026-07446

CVE-2026-48844

OPENSUSE-SU-2026:10869-1

OPENSUSE-SU-2026:20852-1

Affected Products

Roundcube Webmail

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48844.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-48844 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48844 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48844 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48844 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10869-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07446 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48844 · Security Note
• https://ubuntu.com/security/CVE-2026-48844 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 · Note
• https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a · Note
• https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862 · Note
• https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 · Note