{"id":"CVE-2026-48842","published":"2026-05-25T19:06:37Z","modified":"2026-09-25T03:55:21Z","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the…","vendor":"Roundcube","product":"Webmail","tier":"core","eol":null,"affectedVersions":[{"vendor":"Roundcube","product":"Webmail","versions":[">= 1.6.0, < 1.6.16",">= 1.7.0, < 1.7.1"]}],"description":{"text":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01699,"percentile":0.77174,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-09-21","exploitedFirstSeen":"2026-09-21","ransomware":false,"evidence":[{"url":"https://ess.coalitioninc.com/cve/?id=CVE-2026-48842&alert=2026-09-21","date":"2026-09-21"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503","date":"2026-09-21"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":12,"pulses":[{"name":"FortiMail CVE-2026-104286 KEV — Unauth File Write Exploitation","url":"https://otx.alienvault.com/pulse/6ac09adc442060e13fb5270a","created":"2026-10-03"},{"name":"CISA Flags Two Actively Exploited Citrix NetScaler Zero Days in Known Exploited Vulnerabilities Catalog","url":"https://otx.alienvault.com/pulse/6aba49f9062b8de6f758f9dd","created":"2026-09-28"},{"name":"Major vulnerability found in ancient TACACS+ networking protocol","url":"https://otx.alienvault.com/pulse/6aba01ac0804b48d10b4a38f","created":"2026-09-28"},{"name":"Major vulnerability found in ancient TACACS+ networking protocol","url":"https://otx.alienvault.com/pulse/6ab61e2ec525754334a6ed2d","created":"2026-09-25"},{"name":"Known_Cve | Jun 3, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1ee53f4af43df5b5f4403e","created":"2026-06-02"},{"name":"Known_Cve | Jun 2, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1d945db4f5a5371b3864a3","created":"2026-06-01"},{"name":"Known_Cve | Jun 1, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1c426cbf0e554982e6da7a","created":"2026-05-31"},{"name":"Known_Cve | May 31, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a1af0efff4b7dd243573ef5","created":"2026-05-30"},{"name":"Known_Cve | May 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a199f66a765b0a5dce00131","created":"2026-05-29"},{"name":"Known_Cve | May 29, 2026","url":"https://otx.alienvault.com/pulse/6a184eb0b82a588940895fc7","created":"2026-05-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.1","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.16","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/03/17","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-31719","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31719","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2026-09-25","earliestUrl":"https://github.com/murrez/CVE-2026-48842","repos":[{"name":"4minx/CVE-2026-48842","url":"https://github.com/4minx/CVE-2026-48842","stars":2,"created":"2026-09-27"},{"name":"murrez/CVE-2026-48842","url":"https://github.com/murrez/CVE-2026-48842","stars":1,"created":"2026-09-25"},{"name":"XsanFlip/POC-CVE-2026-48842","url":"https://github.com/XsanFlip/POC-CVE-2026-48842","stars":1,"created":"2026-10-03"}]},"first":{"date":"2026-09-25","source":"PoC-in-GitHub","url":"https://github.com/murrez/CVE-2026-48842"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-05-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-48842","provenance":"source"},{"date":"2026-09-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://ess.coalitioninc.com/cve/?id=CVE-2026-48842&alert=2026-09-21","provenance":"source"},{"date":"2026-09-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/murrez/CVE-2026-48842","provenance":"source"}],"speed":{"daysToPublicExploit":123,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 40 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.43,"detail":"percentile 0.7717"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.53,"detail":"12 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}