Loading vulnerability…
Remote image blocking bypass in Roundcube Webmail via crafted CSS var()
CVE-2026-48846 affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The vulnerability allows the application's remote image blocking feature to be bypassed by sending an e-mail message containing a crafted CSS var() value. Based on the provided context, this is a protection-bypass flaw in the handling or sanitization of CSS content within rendered e-mail messages, allowing externally referenced content to evade Roundcube's intended remote image restrictions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to bypass Roundcube's remote image blocking protections. This may result in information disclosure, such as leaking recipient-related metadata through external resource retrieval, and may also constitute an access-control bypass by defeating a security feature intended to prevent unsolicited remote content loading from e-mail messages.
If you can’t patch tonight, do this now.
Apply the available vendor patches or distribution security updates. No separate workaround or temporary mitigation was provided in the supplied advisories.
Patch, then assume compromise.
Upgrade Roundcube Webmail to a fixed release: 1.6.16 or later on the 1.6.x branch, or 1.7.1 or later on the 1.7.x branch. Debian users should apply the vendor security updates, including the fixed roundcube packages referenced in the advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.