CVE-2026-48849: Roundcube Webmail

Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days.

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

Affected products

• Roundcube Webmail: from 1.6.0, before 1.6.16 (fixed in 1.6.16); from 1.7.0, before 1.7.1 (fixed in 1.7.1)

Published 2026-05-25. Last modified 2026-07-24.