Executive brief
Roundcube Webmail, a widely used open-source email client, contains a critical security flaw in its virtuser_query plugin. This vulnerability allows an unauthenticated attacker to execute malicious database commands before even logging in. Successful exploitation could lead to the theft of sensitive user data, unauthorized access to email accounts, or a complete compromise of the mail server's database.
Technical details
A SQL injection vulnerability exists in the virtuser_query plugin of Roundcube Webmail. The flaw is rooted in an improper neutralization of special elements (CWE-89) where a backslash escape bypass occurs during the processing of input via the PHP preg_replace() function. Because this occurs in the virtuser_query component, which is often used for user lookups during the login phase, the vulnerability can be triggered by a remote, unauthenticated attacker (pre-authentication). An attacker can exploit this to execute arbitrary SQL queries against the backend database. The issue is resolved in versions 1.6.16 and 1.7.1.
Affected products
- Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1
Timeline
- 2026-05-24: patched: Roundcube released versions 1.6.16 and 1.7.1 to address the issue.
- 2026-05-25: disclosed: CVE-2026-48842 was published.
References
- https://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9
- https://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
- https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1