CVE-2026-48844

Published May 25, 2026

Last updated 3 days ago

LDAP

Roundcube Webmail

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48844 describes a vulnerability found in Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1. The flaw originates from insecure code evaluation logic within the LDAP `autovalues` option. This vulnerability could allow an authenticated user to inject and execute arbitrary code, potentially leading to remote code execution on the Roundcube server. To mitigate this issue, support for code evaluation in the LDAP `autovalues` option has been removed in Roundcube Webmail versions 1.6.16 and 1.7.1.

Description: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
Source: cve@mitre.org
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 5.9
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-670

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 16

References

Sources include official advisories and independent security research.