PT-2026-43110 · Unknown · Roundcube Webmail

Zazy · Published 2026-05-24 · Updated 2026-05-27 · CVE-2026-48847

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x through 1.6.15 Roundcube Webmail versions 1.7.x through 1.7.0

Description An issue allows pre-authentication arbitrary file deletion through a session poisoning bypass when using redis or memcache. Session poisoning is a technique where an attacker manipulates session data to deceive the application into granting unauthorized access or performing unintended actions.

Recommendations Update versions 1.6.x to 1.6.16. Update versions 1.7.x to 1.7.1.

Exploit

Fix

Weakness Enumeration

CWE-669

Related Identifiers

BDU:2026-07443

CVE-2026-48847

OPENSUSE-SU-2026:10869-1

OPENSUSE-SU-2026:20852-1

Affected Products

Roundcube Webmail

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48847.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-48847 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48847 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48847 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07443 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48847 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48847 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10869-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48847 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48847 · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 · Note
• https://github.com/roundcube/roundcubemail/commit/a4eb375b98cc3d055de665c34efc729dd8ef272a · Note
• https://github.com/roundcube/roundcubemail/commit/703318e6a59515b73b0d8aa2a91e346b02f56baa · Note
• https://t.me/CVEtracker/54906 · Telegram Post