CVE-2026-48844

EUVD-2026-31717
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.71%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
roundcubewebmail
1.6.0 ≤
𝑥
< 1.6.16
CNA
roundcubewebmail
1.7.0 ≤
𝑥
< 1.7.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
roundcube
bookworm
1.6.5+dfsg-1+deb12u9
fixed
bookworm (security)
1.6.5+dfsg-1+deb12u10
fixed
bullseye
vulnerable
bullseye (security)
1.4.15+dfsg.1-1+deb11u10
fixed
forky
1.6.18+dfsg-1
fixed
sid
1.6.18+dfsg-1
fixed
trixie
1.6.16+dfsg-0+deb13u1
fixed
trixie (security)
1.6.17+dfsg-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
roundcube
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862
https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a
https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1