Roundcube Webmail Patches Pre-Auth SQLi, Code Injection, and RCE-Class Flaws

Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions 1.6.16 and 1.7.1, following earlier fixes in 1.6.14 for the 1.6.x line. The newly disclosed issues include CVE-2026-48842, a pre-authentication SQL injection flaw in the virtuser_query plugin with a CVSS score of 8.1, and CVE-2026-48844, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as CVE-2026-48845 through CVE-2026-48849, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities.

Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include y0us, Georgios Tsimpidas, flydragon777, the Martila Security Research Team, aikido_security, and nullcathedral. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.