CVE-2026-48844

high

Description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

References

https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1

https://github.com/roundcube/roundcubemail/releases/tag/1.7.1

https://github.com/roundcube/roundcubemail/releases/tag/1.6.16

https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a

https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862

Details

Source: Mitre, NVD

Published: 2026-05-25

Updated: 2026-05-26

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H