CVE-2026-48844 - Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection

Back Back to CVE browser

HIGH

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection

Published May 25, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.51%

Description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

Affected products

Vendor Roundcube Product Webmail Default
unaffected
- Version
  1.6.0
  Status
  affected
  Constraints
  <1.6.16
- Version
  1.7.0
  Status
  affected
  Constraints
  <1.7.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Roundcube

Webmail

unaffected

Version	Status	Constraints
1.6.0	affected	<1.6.16
1.7.0	affected	<1.7.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-670

References (5)

Link	Providers	Tags
https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862
https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a
https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1