VulnSocial

CVE-2026-48848Patch

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-29); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-29: 1Mentions · 2026-06-02: 1Patch / Workaround · 2026-05-29: 1Technical Details · 2026-05-29: 105-2906-02
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-05-291
Patch1
2026-06-021
Disclosure1
Full discourse2 posts
  • Rıdvan Yağlı@ridvanyagli
    Patch

    Roundcube 1.6.16 öncesi ve 1.7.1 öncesi sürümleri etkileyen yüksek CVSS skorlu Güvenlik Açıkları duyuruldu. SQL Injection ve RCE riski var. Roundcube sürümünüzü 1.7.1 veya 1.6.16 sürümlerinden birine güncelleyin. CVE: CVE-2026-48842 CVE-2026-48843 CVE-2026-48848 CVE-2026-48844

    Post summary

    High‑severity CVEs (CVE-2026-48842, 48843, 48848, 48844) affecting Roundcube versions prior to 1.6.16 and 1.7.1 are announced, with SQL injection and RCE risks; users are advised to update to the specified versions.

    00020382
    1.2K followersView on X
  • CERT-PY@CERTpy
    Disclosure

    ⚠️ Vulnerabilidades en productos Roundcube ❗ CVE-2026-48848 ❗ CVE-2026-48844 ❗ CVE-2026-48842 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-roundcube-2/ https://t.co/SiNDcHSZ7h

    Post summary

    The message announces new vulnerabilities in Roundcube products, listing CVE identifiers and directing readers to external sites for more details, but provides no PoC, exploitation data, or remediation information.

    00000172
    6.7K followersView on X

Explore more

Back to dashboard