Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Roundcubemail Security Update Fixes Multiple Risks
published 5 months ago
Summary
This update fixes several security issues in Roundcubemail, including potential data loss, unauthorized access, and code execution. It's recommended to apply this update to prevent these risks. If you're using Roundcubemail, update it as soon as possible to ensure your system remains secure.
Original advisory text
Security update for roundcubemail
This update for roundcubemail fixes the following issues:
Changes in roundcubemail:
- update to 1.6.16
+ Fix potential too long value in IMAP ID command (#10136)
+ Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]
+ Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336]
+ Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]
+ Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]
+ Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]
+ Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]
+ Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]
+ Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]
Changes in roundcubemail:
- update to 1.6.16
+ Fix potential too long value in IMAP ID command (#10136)
+ Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]
+ Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336]
+ Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]
+ Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]
+ Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]
+ Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]
+ Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]
+ Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]
References
- https://bugzilla.suse.com/1266329 Third Party Advisory
- https://bugzilla.suse.com/1266331 Third Party Advisory
- https://bugzilla.suse.com/1266332 Third Party Advisory
- https://bugzilla.suse.com/1266333 Third Party Advisory
- https://bugzilla.suse.com/1266334 Third Party Advisory
- https://bugzilla.suse.com/1266335 Third Party Advisory
- https://bugzilla.suse.com/1266336 Third Party Advisory
- https://bugzilla.suse.com/1266337 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-48842 URL
- https://www.suse.com/security/cve/CVE-2026-48843 URL
- https://www.suse.com/security/cve/CVE-2026-48844 URL
- https://www.suse.com/security/cve/CVE-2026-48845 URL
- https://www.suse.com/security/cve/CVE-2026-48846 URL
- https://www.suse.com/security/cve/CVE-2026-48847 URL
- https://www.suse.com/security/cve/CVE-2026-48848 URL
- https://www.suse.com/security/cve/CVE-2026-48849 URL
Timeline
Published31 May 2026
Updated2 Jun 2026
First seen2 Jun 2026
Sources
openSUSE-SU-2026:20852-1 · OSV
Track software like this
Free during beta