Roundcube Webmail CVE-2026-48847

Roundcube must be explicitly configured to use Redis or Memcache as its session storage backend (set via $config['session_storage'] = 'redis' or 'memcache'); the default file-based or database session storage is NOT affected. The attacker must also have network write access to the Redis (default port 6379) or Memcache (default port 11211) instance - for example, through an internet-exposed cache server with no authentication, or through a network-adjacent position. The CVSS AC:H factor confirms this is a non-trivial precondition. Exploitation is further limited by an availability impact rated Low (A:L), indicating the file deletion is bounded in scope rather than enabling wholesale filesystem destruction. No user interaction is required and no credentials are needed on the Roundcube application itself, but the Redis/Memcache write access requirement is the decisive limiting factor for real-world exploitation.

CVSS 3.7 (Low) is driven by AC:H (high attack complexity), S:U (unchanged scope), and A:L (low availability impact), which together substantially suppress the score despite PR:N (no privileges required) and AV:N (network-accessible). The AC:H factor is the critical limiter: exploitation is not straightforward and requires the attacker to have write access to the Redis or Memcache instance - a non-trivial precondition. EPSS at 0.06% (18th percentile) corroborates low real-world exploitation probability. SSVC signals align: Exploitation: none, Automatable: no, Technical Impact: partial. No CISA KEV listing exists. The gap between the pre-auth nature of the bug and its low CVSS score is explained by the constrained impact (file deletion bounded by A:L, no confidentiality or integrity impact per CVSS vector) and the access requirement for the backend cache. For organizations running Redis or Memcache with weak network segmentation or no authentication, real-world risk is moderately elevated above what the raw score suggests. For those using file or database session storage, this CVE poses no exposure.

An attacker who has access to an exposed or unauthenticated Redis instance serving as Roundcube's session backend writes a specially crafted session payload designed to spoof a valid pre-authentication state and direct file deletion logic to a target path. When Roundcube's session handler loads this poisoned record during a standard unauthenticated request, it bypasses the pre-auth guard and executes the file deletion. No public exploit code has been identified at time of analysis, and the AC:H rating indicates this requires knowledge of Roundcube's session format and reliable write access to the cache backend.