CVE-2026-48849

Roundcube Webmail before 1.6.18 and 1.7.3 has a vulnerability in the modoboa driver of the password plugin that could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver.

Roundcube Webmail before 1.6.18 and 1.7.3 has insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure, e.g., if stylesheet links point to local network hosts. This is due to incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643.

Roundcube Webmail before 1.6.18 and 1.7.3 has improper rule name quoting that could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This affects only instances using the managesieve plugin.

Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.

Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to LDAP search filter injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.