Multiple vulnerabilities affecting Roundcube Webmail

Roundcube Webmail is an open source webmail client that allows users to access and manage their email through a web browser. This email client is affected by several vulnerabilities labeled as follows: CVE-2026-48842: This vulnerability results from a bypass of the backslash escape mechanism in the preg_replace() function within the virtuser_query plugin. Exploitation of this vulnerability would allow an unauthenticated malicious actor to perform SQL injections on affected systems. This vulnerability is classified as high with a severity score of 8.1 according to CVSS v3.1. CVE-2026-48843: This vulnerability results from insufficient validation of style sheets (CSS) embedded in HTML formatted messages. Exploitation of this vulnerability would allow an unauthenticated attacker to trigger Server-Side Forged Requests (SSRF) or disclose sensitive information when a user views a malicious email. This vulnerability is classified as high with a severity score of 7.2 according to CVSS v3.1. CVE-2026-48844: This vulnerability is due to the presence of insecure dynamic code evaluation logic in the autovalues ​​option of the LDAP module. Exploitation of this vulnerability would allow an authenticated malicious actor to inject arbitrary code onto affected systems. This vulnerability is classified as high with a severity score of 7.5 according to CVSS v3.1.

• Roundcube Webmail versions 1.6.x prior to 1.6.16;
• Versions 1.7.x prior to 1.7.1 of Roundcube Webmail;