{"id":"CVE-2026-48849","published":"2026-05-25T19:30:38Z","modified":"2026-05-26T13:01:11Z","title":"In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored…","vendor":"Roundcube","product":"Webmail","tier":"tail","description":{"text":"In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00239,"percentile":0.14926,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.1","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/commit/189d30a4890319cd687df959ca9f768a3a613d61","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.16","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/commit/a21519187873ce962db029b6ff68e47bd7f3fd8a","tags":[]}],"priority":{"score":11.1,"factors":[{"name":"EPSS percentile","points":2.99},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.08}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-15","earliestUrl":"https://github.com/AnandJogawade/CVE-2026-48849-Roundcube-Webmail-Stored-XSS","repos":[{"name":"AnandJogawade/CVE-2026-48849-Roundcube-Webmail-Stored-XSS","url":"https://github.com/AnandJogawade/CVE-2026-48849-Roundcube-Webmail-Stored-XSS","stars":1,"created":"2026-06-15"}]},"first":{"date":"2026-06-15","source":"PoC-in-GitHub","url":"https://github.com/AnandJogawade/CVE-2026-48849-Roundcube-Webmail-Stored-XSS"},"provenance":"source"},"vendorSlug":"roundcube","affectedVersions":[{"vendor":"Roundcube","product":"Webmail","versions":[">= 1.6.0, < 1.6.16",">= 1.7.0, < 1.7.1"]}],"euvd":{"id":"EUVD-2026-31728","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-roundcube-webmail-cwe-79"}}