Roundcube Webmail up to 1.6.15/1.7.0 Email Message resource transfer

Summaryinfo

A vulnerability classified as critical was found in Roundcube Webmail up to 1.6.15/1.7.0. This affects an unknown part of the component Email Message Handler. Executing a manipulation can lead to resource transfer. The identification of this vulnerability is CVE-2026-48845. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Roundcube Webmail up to 1.6.15/1.7.0. This vulnerability affects an unknown function of the component Email Message Handler. The manipulation with an unknown input leads to a resource transfer vulnerability. The CWE definition for the vulnerability is CWE-669. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

The advisory is available at roundcube.net. This vulnerability was named CVE-2026-48845 since 05/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 316802 (Linux Distros Unpatched Vulnerability : CVE-2026-48845), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.6.16 or 1.7.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (316802) and EUVD (EUVD-2026-31720). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Mail Client Software

Vendor

• Roundcube

Name

• Webmail

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.7.0

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion