Roundcube Webmail CVE-2026-48848

Exploitation requires the target Roundcube instance to be running an affected version (1.6.0-1.6.15 or 1.7.0) with HTML message rendering enabled (the default), and the victim must open or preview an attacker-supplied email containing the crafted SVG <animate attributeName="style"> payload - no Roundcube account or authentication is needed on the attacker side because delivery is via ordinary SMTP. Limiting factors: deployments configured to display mail as plain text only are not exploitable, the impact is constrained to the victim's browser session under the webmail origin (not server-side code execution), and CVSS C:L/I:L indicates only partial confidentiality/integrity loss rather than full account takeover absent chaining with further gadgets.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N describes network-reachable, low-complexity exploitation with changed scope and partial confidentiality/integrity impact - consistent with a stored XSS/CSS-injection that fires when a victim opens an attacker-controlled email. However, the UI:N component is debatable for a webmail XSS: realistically a user must open the malicious message, which the vector treats as part of normal browsing rather than 'interaction.' EPSS at 0.04% (14th percentile) and the absence from CISA KEV signal that no broad exploitation is observed, but XSS in webmail is historically attractive for targeted phishing and session theft against high-value mailboxes, so the low EPSS should not be read as 'safe to defer.' SSVC data is not provided. Overall this is a real-but-moderate priority: patch within normal monthly cadence unless the deployment is internet-exposed and hosts privileged users, in which case accelerate.

An attacker emails a target Roundcube user a message containing an SVG block with <animate attributeName="style" ...> that survives the HTML sanitizer; when the victim opens the message in the webmail UI, the animation rewrites the page's CSS to exfiltrate styled content, overlay a credential-harvesting form, or pivot via further script gadgets. No public exploit identified at time of analysis, though the upstream fix and reporter credit (wooseokdotkim) suggest reproduction details could surface from diffing the patch commits.