CVE-2026-48849

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.x through 1.6.15 Roundcube Webmail versions 1.7.x through 1.7.0

Description An unsanitized subject field in the draft restored value allows for stored Cross-Site Scripting (XSS), HTML, and CSS injection on shared mailboxes. XSS is a technique where malicious scripts are injected into trusted websites, which are then executed in the browser of the user viewing the page.

Recommendations Update to version 1.6.16 for the 1.6.x branch. Update to version 1.7.1 for the 1.7.x branch.