What is the CVSS score of CVE-2026-48844?

CVE-2026-48844 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Roundcube Webmail are affected by CVE-2026-48844?

Roundcube Webmail versions 1.6.x and 1.7.x contain a code injection vulnerability allowing authenticated attackers to execute arbitrary PHP code, potentially compromising email systems and sensitive…. A patch is available.

How to fix or mitigate CVE-2026-48844?

24 hours: Inventory all Roundcube instances and identify those running 1.6.x (before 1.6.16) or 1.7.x (before 1.7.1). 7 days: Begin deploying vendor patches-upgrade 1.6.x branch to 1.6.16 or later, and 1.7.x branch to 1.7.1 or later. 30 days: Complete patching of all affected Roundcube installations.

Roundcube Webmail CVE-2026-48844

EUVD-2026-31717 HIGH

Always-Incorrect Control Flow Implementation (CWE-670)

2026-05-25 mitre

GHSA-qhxr-pc4x-jrq3

Code Injection Webmail

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 10:26 vuln.today

Analysis Generated

Jun 08, 2026 - 10:26 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

AnalysisAI

Code injection in Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows authenticated attackers to execute arbitrary PHP via the LDAP autovalues option, which previously evaluated user-influenced expressions as code. The upstream maintainers removed code evaluation support entirely in the fixed releases. EPSS sits at 0.05% (14th percentile) and there is no public exploit identified at time of analysis, but the issue is patched and rated CVSS 7.5.

Technical ContextAI

Roundcube is a widely deployed PHP-based IMAP webmail client commonly bundled with hosting control panels and Linux distributions (the Suse tag in this record reflects downstream packaging). The vulnerable code path lives in the LDAP address book integration, specifically the autovalues feature used to derive contact attributes from templated expressions. The maintainers' chosen fix - removing code evaluation entirely (commits 6a777d7 and ea1798a) - indicates the legacy implementation passed templated values into a PHP evaluator, fitting CWE-670 (Always-Incorrect Control Flow Implementation) where a control transfer to interpreted code occurred under conditions that allowed attacker-influenced data to drive execution.

RemediationAI

Vendor-released patch: upgrade to Roundcube Webmail 1.6.16 (for the 1.6.x branch) or 1.7.1 (for the 1.7.x branch), both published 2026-05-24 - these releases remove code evaluation support from the LDAP autovalues option entirely, per commits 6a777d7394b763ce9acfce86c1a521e14a02d862 and ea1798a6fbf060abcc0ba73b2435036bf8016a5a. If immediate upgrade is not possible, audit your LDAP address book configuration and remove or simplify any autovalues entries that rely on templated expressions, accepting the trade-off that derived contact attributes (such as composed display names or computed mail addresses) will need to be sourced directly from LDAP fields instead. As a stronger compensating control, disable LDAP address book integration in config/config.inc.php until patched, which will break enterprise directory lookups for users but eliminates the vulnerable code path. Consult the vendor advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 and back up data before upgrading as the release notes explicitly recommend.