CVE-2026-48844
7.5
HIGH
CVSS 3.1
EPSS 0.41%
Description
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
How to fix CVE-2026-48844
To remediate CVE-2026-48844, upgrade the affected package to a fixed version below.
- Debian/roundcube—upgrade to 1.4.15+dfsg.1-1+deb11u9 or later
Is CVE-2026-48844 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.4.15+dfsg.1-1+deb11u9
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |