PT-2026-43111 · Unknown · Roundcube Webmail

Wooseokdotkim · Published 2026-05-24 · Updated 2026-05-27 · CVE-2026-48848

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x through 1.6.15 Roundcube Webmail versions 1.7.x prior to 1.7

Description Insufficient HTML sanitization allows for Cascading Style Sheets (CSS) injection. This occurs when an SVG document contains an animate element utilizing the attributeName attribute.

Recommendations Update versions 1.6.x to 1.6.16. Update versions 1.7.x to 1.7.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-07448

CVE-2026-48848

OPENSUSE-SU-2026:10869-1

OPENSUSE-SU-2026:20852-1

Affected Products

Roundcube Webmail

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48848.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-48848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48848 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-48848 · Security Note
• https://ubuntu.com/security/CVE-2026-48848 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10869-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07448 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48848 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48848 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48848 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 · Note
• https://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27 · Note
• https://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9 · Note
• https://t.me/CVEtracker/54908 · Telegram Post