CVE-2026-48844

EUVD-2026-31717
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
roundcubewebmail
1.6.0 ≤
𝑥
< 1.6.16
CNA
roundcubewebmail
1.7.0 ≤
𝑥
< 1.7.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
roundcube
bookworm
vulnerable
bookworm (security)
1.6.5+dfsg-1+deb12u9
fixed
bullseye
vulnerable
bullseye (security)
1.4.15+dfsg.1-1+deb11u9
fixed
forky
1.6.17+dfsg-1
fixed
sid
1.6.17+dfsg-1
fixed
trixie
vulnerable
trixie (security)
1.6.16+dfsg-0+deb13u1
fixed
Common Weakness Enumeration
References
https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862
https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a
https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1