CVE-2026-48848_CVE-2026-48848

7.2 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

Basic Information

ID CVE-2026-48848

Source mitre

Published May 25, 2026 at 19:27

Affected Product

Vendor Roundcube

Product Webmail

Version 1.6.0

Affected Versions Roundcube Webmail 1.6.0
Roundcube Webmail 1.7.0

CWE Classification

CWE-79

References

{
    "lastseen": "",
    "description": "Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.",
    "published": "2026-05-25T19:27:54.841Z",
    "modified": "2026-05-25T19:27:54.841Z",
    "type": "cve",
    "title": "CVE-2026-48848",
    "source": "mitre",
    "references": "https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.1\nhttps://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16\nhttps://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27",
    "id": "CVE-2026-48848",
    "bulletinFamily": "",
    "cwe": [
        "CWE-79"
    ],
    "cvelist": null,
    "sourceData": "Roundcube Webmail 1.6.0\nRoundcube Webmail 1.7.0",
    "sourceHref": "",
    "cvss": {
        "score": 7.2,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Webmail",
    "version": "1.6.0",
    "vendor": "Roundcube",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}