Roundcube Webmail CVE-2026-48844

Requires a Roundcube deployment where the LDAP address book is enabled AND the administrator configured the autovalues option using templated expressions (the feature whose evaluation path was removed in 1.6.16/1.7.1). The attacker must also hold valid Roundcube credentials (CVSS PR:L) to reach the address book functionality, and CVSS AC:H indicates additional non-trivial conditions on the template content or LDAP entry data that the attacker must influence. Roundcube deployments without LDAP address book integration, or with autovalues defined as plain LDAP attribute references rather than evaluated expressions, are not exploitable.

Signals are mixed and lean toward moderate, not critical. CVSS 7.5 with AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:H reflects network reach and full CIA impact but flags both high attack complexity and required low-level privileges, meaning an attacker needs a valid Roundcube account and must satisfy non-trivial preconditions in the LDAP autovalues template. EPSS at 0.05% (14th percentile) and the absence of KEV listing or known public PoC suggest no widespread exploitation activity at this time. The vulnerability is real and patchable, but it is not an internet-spray candidate; prioritize it behind any unauthenticated Roundcube bug (such as the pre-auth SQLi and arbitrary file delete fixed in the same release) but ahead of routine hardening. Note: 'low privileges' here per CVSS likely refers to an authenticated mail user, while exploitability further depends on administrative LDAP autovalues configuration - verify your deployment uses templated autovalues before deprioritizing.

An attacker with a valid Roundcube mail account on a server whose administrators configured the LDAP address book with autovalues templates crafts contact or address-book input that, when expanded by the autovalues evaluator, yields PHP code; submitting the input through the address book causes the Roundcube backend to evaluate that code, granting arbitrary code execution under the webmail user. No public exploit is identified at time of analysis, but the patch commits themselves reveal the vulnerable evaluation pattern to anyone reviewing the diff.