CVE-2026-48845
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in Roundcube Webmail versions 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1. Remote image blocking was not honored for URLs pointing to local/private destinations, potentially leading to information disclosure or privilege escalation via HTML email.
Risk Assessment
Risk of disclosure of sensitive information or privilege escalation through embedded images in email messages.
Recommendation
Update Roundcube Webmail to version 1.6.17 or 1.7.1. Implement additional content filters for HTML messages.
Other vulnerabilities in Roundcube Webmail
See all- CVE-2026-75010Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has a vulnerability in the modoboa driver of the password plugin that could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver.
- CVE-2026-75006Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure, e.g., if stylesheet links point to local network hosts. This is due to incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643.
- CVE-2026-75004Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has improper rule name quoting that could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This affects only instances using the managesieve plugin.
- CVE-2026-74999Medium
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.
- CVE-2026-74998High
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.
- CVE-2026-74997High
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
- CVE-2015-5383High
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
- CVE-2017-8114High
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- CVE-2016-4069High
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
- CVE-2026-75007Medium
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to LDAP search filter injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
Original NVD description (English source)
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.