Risks
- Compromise of data integrity
- Compromise of data confidentiality
- Circumvention of security policy
- Remote arbitrary code execution
- Server-side request forgery (SSRF)
- SQL Injection (SQLi)
Affected Systems
- Roundcube Webmail versions 1.6.x prior to 1.6.16
- Roundcube Webmail versions 1.7.x prior to 1.7.1
Summary
Multiple vulnerabilities have been discovered in Roundcube. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality, and a breach of data integrity.
Solutions
Refer to the vendor's security bulletin to obtain patches (see Documentation section).
Documentation
- Roundcube security bulletin security-updates-1.6.16-and-1.7.1 of May 24, 2026: https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
- CVE Reference CVE-2026-48842: https://www.cve.org/CVERecord?id=CVE-2026-48842