CVE-2026-48842
published 2026-05-25CVE-2026-48842: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…
PriorityP278high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
0.89%
59.1th percentile
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.16 | 1.6.16 |
| roundcube | webmail | >= 1.7.0 < 1.7.1 | 1.7.1 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvelistv5v3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vc2v-cxrw-6g4p: Roundcube Webmail 1
ghsa_unreviewed·2026-05-26
CVE-2026-48842 [HIGH] CWE-89 GHSA-vc2v-cxrw-6g4p: Roundcube Webmail 1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
CVEList
CVE-2026-48842: Roundcube Webmail 1
cvelistv5·2026-05-25·CVSS 8.1
CVE-2026-48842 [HIGH] CWE-89 CVE-2026-48842: Roundcube Webmail 1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
VulDB
Roundcube Webmail up to 1.6.15/1.7.0 preg_replace sql injection
vuldb·2026-05-25
CVE-2026-48842 [CRITICAL] Roundcube Webmail up to 1.6.15/1.7.0 preg_replace sql injection
A vulnerability, which was classified as critical, was found in Roundcube Webmail up to 1.6.15/1.7.0. This issue affects the function preg_replace. The manipulation results in sql injection.
This vulnerability is identified as CVE-2026-48842. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
VulnCheck
Roundcube Webmail Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2026·CVSS 8.1
CVE-2026-48842 [HIGH] Roundcube Webmail Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Roundcube Webmail Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Affected: Roundcube Webmail
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://ess.coalitioninc.com/cve/?id=CVE-2026-48842&alert=2026-09-21
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [fedora-all]
bugzilla·2026-05-26·CVSS 8.1
CVE-2026-48842 [HIGH] CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [fedora-all]
CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [epel-all]
bugzilla·2026-05-26·CVSS 8.1
CVE-2026-48842 [HIGH] CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [epel-all]
CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass
bugzilla·2026-05-25·CVSS 8.1
CVE-2026-48842 [HIGH] CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass
CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Hackernews
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
blogs_hackernews·2026-09-25·CVSS 8.8
CVE-2026-48842 [HIGH] Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.
The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
The issue stems from a preg_replace() backslash escape bypass that allows attackers to inject arbitrary SQL statements without authentication.
"Unauthenticated attackers can inject SQL into Roundcube's database bac
https://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9https://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4bhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16https://github.com/roundcube/roundcubemail/releases/tag/1.7.1https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1http://www.openwall.com/lists/oss-security/2026/06/03/17
2026-05-25
Published
Exploited in the wild