7.5 HighCWE-670
CVE-2026-48844
Roundcube Webmail vulnerability
RoundcubeWebmail
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 21 Oct
0.5%probability of exploitation in the next 30 days
Higher than 42% of scored CVEs
SeverityCVSS
7.5High
Description NVD
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
Coverage 1 article · 1 outlet
- Roundcube fixes critical SQL injection and code injection bugsSecurityOnline · first in our coverage · mentions it in passing