Cross-site scripting in Roundcube Webmail - CVE-2026-48848
Published: May 25, 2026 / Updated: September 25, 2026
Vulnerability identifier: #VU132213
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-48848
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary style content.
The vulnerability exists due to improper input validation in the HTML sanitizer when processing SVG animate elements with attributeName="style". A remote attacker can supply specially crafted HTML or SVG content to inject arbitrary style content.
Affected software
Roundcube Webmail
Debian Linux
roundcube (Debian package)
Debian Linux
roundcube (Debian package)
How to mitigate CVE-2026-48848
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.16, 1.7.1
roundcube (Debian package) - addressed in versions 1.6.5+dfsg-1+deb12u9, 1.6.16+dfsg-0+deb13u1
roundcube (Debian package) - addressed in versions 1.6.5+dfsg-1+deb12u9, 1.6.16+dfsg-0+deb13u1