CVE-2026-48845: Roundcube Webmail

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

Affected products

• Roundcube Webmail: from 1.6.14, before 1.6.16 (fixed in 1.6.16); from 1.7.0, before 1.7.1 (fixed in 1.7.1)

Published 2026-05-25. Last modified 2026-07-24.