What is the CVSS score of CVE-2026-48849?

CVE-2026-48849 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48849?

Yes, a patch is available for CVE-2026-48849. Update the affected software to the latest version immediately.

Roundcube Webmail CVE-2026-48849

EUVD-2026-31728 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 mitre

GHSA-2m7q-4j9m-89vh

XSS Webmail

4.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 12:44 vuln.today

Analysis Generated

Jun 08, 2026 - 12:44 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

AnalysisAI

Stored XSS and HTML/CSS injection in Roundcube Webmail 1.6.x and 1.7.x allows an authenticated attacker to plant a malicious payload in a draft message's subject field, which then executes in the browsers of other users when they encounter the draft restore dialog on a shared mailbox. Fixed in versions 1.6.16 and 1.7.1 per vendor advisory published 2026-05-24. No public exploit identified at time of analysis, and EPSS sits at 0.03% (10th percentile), indicating minimal observed exploitation interest.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the draft restore dialog component of Roundcube Webmail. When a draft is saved and subsequently restored, the subject field value is reflected back into the DOM without adequate sanitization, allowing embedded HTML, CSS, or JavaScript to be interpreted by the browser. The Changed scope (S:C) in the CVSS vector reflects that the injected payload can affect browser sessions of users beyond the original attacker, a characteristic of stored XSS in multi-user shared mailbox contexts. The affected codebase is confirmed via CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* across both the 1.6.x and 1.7.x branches. Two separate commits address this issue: commit 189d30a4 on the 1.7.x branch and commit a21519187 on the 1.6.x branch, as referenced in GitHub release tags 1.7.1 and 1.6.16 respectively.

RemediationAI

The primary fix is to upgrade to Roundcube Webmail 1.6.16 (for 1.6.x deployments) or 1.7.1 (for 1.7.x deployments), both released 2026-05-24 and available at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 and the respective GitHub release tags https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.1. The vendor explicitly recommends backing up data before updating. If an immediate upgrade is not feasible, a compensating control is to restrict or disable shared mailbox access for untrusted or lower-privileged users, thereby eliminating the cross-user exploitation path - note this may impact legitimate collaborative workflows. Disabling draft auto-restore functionality, if configurable, would also neutralize the specific trigger vector, but this has workflow trade-offs. There is no indication a vendor-supported workaround short of patching has been published.