Loading vulnerability…
Stored XSS in Roundcube Webmail draft restore dialog
CVE-2026-48849 is a stored cross-site scripting and HTML/CSS injection vulnerability in Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1. An unsanitized subject field in restored draft values can inject attacker-controlled content into the draft restore dialog on shared mailboxes, potentially executing scripts in a victim's browser.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause stored cross-site scripting or HTML/CSS injection in shared mailboxes. Potential consequences include browser-side script execution, session compromise, phishing, and unauthorized actions in the victim's webmail context.
If you can’t patch tonight, do this now.
No separate vendor workaround is provided in the supplied content beyond applying the security update. As a temporary risk-reduction measure, limit exposure of shared mailboxes and avoid restoring or viewing untrusted draft content until patched, but the authoritative mitigation in the provided material is to update to the fixed versions.
Patch, then assume compromise.
Upgrade Roundcube Webmail to 1.6.16 or later in the 1.6.x branch, or 1.7.1 or later in the 1.7.x branch. For Debian installations, upgrade to 1.6.5+dfsg-1+deb12u9 on bookworm or 1.6.16+dfsg-0+deb13u1 on trixie, or a subsequent security-fixed package.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.