Loading vulnerability…
SVG-based CSS injection in Roundcube Webmail
CVE-2026-48848 is an HTML sanitization bypass in Roundcube Webmail that permits CSS injection through a crafted SVG document containing an animate element with an attributeName attribute. The vulnerability affects Roundcube 1.6.x before 1.6.16 and vulnerable 1.7.x releases. Malicious SVG content can bypass the core HTML sanitizer and introduce attacker-controlled styles into the webmail interface. The precise affected-version boundary for the 1.7.x branch is inconsistently specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary CSS injection and may alter content rendered in the webmail interface. Further client-side abuse is possible, but specific confidentiality, availability, JavaScript execution, or server-side execution consequences are not established for this vulnerability.
If you can’t patch tonight, do this now.
No separate workaround or temporary mitigation is documented. Apply the applicable Roundcube security update.
Patch, then assume compromise.
Upgrade Roundcube Webmail to 1.6.16 or later in the 1.6.x branch, or install the 1.7.1 security update or a later fixed 1.7.x release. For Debian installations, upgrade to at least 1.6.5+dfsg-1+deb12u9 on bookworm or 1.6.16+dfsg-0+deb13u1 on trixie.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.