Loading vulnerability…
Pre-authentication SQL injection in Roundcube Webmail virtuser_query
CVE-2026-48842 is a pre-authentication SQL injection vulnerability in Roundcube Webmail's optional virtuser_query plugin, affecting 1.6.x releases before 1.6.16 and 1.7.x releases before 1.7.1. The plugin performs database-backed mappings between email addresses and mailbox usernames. User-supplied credentials are SQL-escaped using $dbh->escape(), but subsequent preg_replace() processing undermines backslash escaping during query-template substitution. Crafted backslash sequences can consequently alter SQL queries before authentication. Exploitation has been reported in the wild, including attempts against honeypots.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose or modify information accessible to the database account used by Roundcube and may allow deletion of database records or disruption of database availability. The extent of compromise depends on database permissions and deployment configuration. Mail-account credentials or messages may be exposed if stored in an accessible database; SQL injection alone does not establish access to the separate IMAP service, all users' messages, or operating-system-level code execution. Publicly confirmed actor attribution and post-exploitation details are unavailable.
If you can’t patch tonight, do this now.
Disable or remove virtuser_query if it is unnecessary or an immediate upgrade is not possible. This removes the affected plugin's attack path but does not replace updating Roundcube. Restrict the application database account to minimum necessary privileges. Review web-server, PHP, Roundcube, and database logs for suspicious unauthenticated requests, unusual escaping, database errors, anomalous queries, and unexpected data changes. These patterns are hunting hypotheses, not confirmed exploitation indicators.
Patch, then assume compromise.
Upgrade Roundcube Webmail 1.6.x to 1.6.16 or later, or 1.7.x to 1.7.1 or later, preferably using the latest supported maintenance release. The fix replaces preg_replace() with str_replace() for literal placeholder substitution. For Debian installations, apply the distribution security update: 1.6.5+dfsg-1+deb12u9 for bookworm or 1.6.16+dfsg-0+deb13u1 for trixie. Verify the running version after deployment. Investigate previously exposed systems because patching does not eliminate an existing compromise; rotate application database credentials after patching if exploitation is suspected.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
86 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.