Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Threat actors have been exploiting a high-severity vulnerability in Roundcube, the popular open source webmail client, the Canadian Centre for Cyber Security warns.
Tracked as CVE-2026-48842 (CVSS score of 8.1), the security defect is described as an SQL injection in the virtuser_query plugin that can be exploited without authentication.
The plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts.
CVE-2026-48842, however, allows attackers to bypass the protection by using crafted queries containing backslash sequences that defeat the plugin’s regular-expression escaping mechanism.
The attacker’s malicious input invokes the virtuser_query plugin to traverse the preg_replace() filter, resulting in quote characters being concatenated into an SQL string that is sent to the database, SentinelOne explains.
Roundcube resolved the vulnerability in versions 1.6.16 and 1.7.1, which were released in late May.
Advertisement. Scroll to continue reading.
This week, the Canadian Centre for...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
