What is the CVSS score of CVE-2026-48848?

CVE-2026-48848 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Roundcube Webmail are affected by CVE-2026-48848?

Roundcube Webmail versions 1.6.x (before 1.6.16) and 1.7.x (before 1.7.1) contain a CSS injection vulnerability enabling arbitrary script execution when users view crafted emails with no special…. A patch is available.

How to fix or mitigate CVE-2026-48848?

Within 24 hours: Conduct inventory of all Roundcube Webmail deployments and identify instances running 1.6.x (before 1.6.16) or 1.7.x (before 1.7.1). Within 7 days: Upgrade all vulnerable instances to Roundcube Webmail 1.6.16 or 1.7.1 (or later versions), validating functionality in staging environments before production deployment. Within 30 days: Verify patch deployment across all affected systems and document remediation completion.

Roundcube Webmail CVE-2026-48848

EUVD-2026-31727 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 mitre

GHSA-p64r-9rcj-x33x

XSS Webmail

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 09:43 vuln.today

Analysis Generated

Jun 08, 2026 - 09:43 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

AnalysisAI

CSS injection in Roundcube Webmail 1.6.x (before 1.6.16) and 1.7.x (before 1.7.1) allows remote attackers to bypass the HTML sanitizer by embedding an SVG document with an animate element whose attributeName references style, enabling cross-site scripting style attacks against mail recipients. The flaw carries a CVSS 7.2 (changed scope) with no privileges or user interaction required beyond viewing a crafted message, no public exploit identified at time of analysis, and an EPSS of 0.04% (14th percentile) indicating low predicted exploitation volume despite the trivially-triggerable attack vector.

Technical ContextAI

Roundcube is a widely deployed PHP-based webmail client; the affected component is its HTML/SVG sanitization layer (washtml/rcube_washtml) which is responsible for stripping dangerous markup from rendered mail bodies before display in a victim's browser. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) - specifically a sanitizer-bypass using SVG's <animate> element where the attributeName attribute can be set to 'style', causing the SMIL animation engine to mutate inline CSS at runtime even though static style attributes would have been stripped. Upstream commits c960d10 (1.7 branch) and 58e5263 (1.6 branch) tighten the sanitizer to reject this SVG animation pathway. The CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* covers all Roundcube Webmail installations within the affected version ranges.

RemediationAI

Vendor-released patch: upgrade to Roundcube Webmail 1.6.16 (for the 1.6.x branch) or 1.7.1 (for the 1.7.x branch) per https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1; the underlying fix commits are 58e5263 (1.6) and c960d10 (1.7). Distribution users on SUSE or other packaged builds should track their vendor's backport for the equivalent washtml sanitizer change. If immediate patching is not possible, compensating controls include forcing the message preview to plain-text mode (set 'prefer_html' to false in config.inc.php, with the trade-off that users lose rich HTML rendering), disabling display of SVG/remote content via the existing 'show_images' and HTML-display preferences, and fronting the webmail UI with a strict Content-Security-Policy that forbids inline styles and script (note this may break some skins and plugins). Avoid relying on network restrictions alone since exploitation is delivered inside ordinary email and does not require attacker-initiated network access to the server.