CVE-2026-48848

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27
https://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9
https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-25 20:16

Updated : 2026-07-24 10:10

NVD link : CVE-2026-48848

Mitre link : CVE-2026-48848

CVE.ORG link : CVE-2026-48848

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-48848", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48848", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T13:00:37.600791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.16", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-25T20:16:37.413", "references": [{"url": "https://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.16", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.1", "source": "cve@mitre.org"}, {"url": "https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute."}, {"lang": "es", "value": "Roundcube Webmail 1.6.x anterior a 1.6.16 y 1.7.x anterior a 1.7 presenta una sanitizaci\u00f3n HTML insuficiente que podr\u00eda conducir a la inyecci\u00f3n de Hojas de Estilo en Cascada (CSS) a trav\u00e9s de un documento SVG que tiene un elemento animate con el atributo attributeName."}], "lastModified": "2026-07-24T10:10:00.197", "sourceIdentifier": "cve@mitre.org"}