Loading vulnerability…
Code injection in Roundcube Webmail LDAP autovalues
CVE-2026-48844 is a code injection vulnerability in the LDAP autovalues option of Roundcube Webmail. It affects the 1.6.x branch before 1.6.16 and the 1.7.x branch before 1.7.1. Insecure code evaluation logic can permit injected code to execute on the server. Versions 1.6.16 and 1.7.1 remove support for this code evaluation behavior.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in code injection and arbitrary command execution on the Roundcube server. The execution privilege level and specific effects on confidentiality or availability are not established.
If you can’t patch tonight, do this now.
No confirmed workaround is available. Until patched, limit exposure of vulnerable Roundcube instances and LDAP-related functionality; these measures are not established as preventing exploitation.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.16 or later in the 1.6.x branch, or version 1.7.1 or later in the 1.7.x branch. These releases remove the vulnerable code evaluation functionality. For Debian packages, install version 1.6.5+dfsg-1+deb12u9 or later for bookworm, or 1.6.16+dfsg-0+deb13u1 or later for trixie.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.