Executive brief
Roundcube Webmail, a widely used open-source web-based email client, contains a security vulnerability in its LDAP address book integration. An attacker with low-level access could exploit insecure code evaluation logic to execute unauthorized commands on the server. This could lead to a full system compromise, unauthorized access to sensitive emails, or disruption of mail services.
Technical details
A code injection vulnerability exists in Roundcube Webmail's LDAP implementation due to insecure code evaluation logic within the 'autovalues' option. The flaw allows an authenticated attacker with network access to trigger the execution of arbitrary code by exploiting how the application processes LDAP configuration values. The vulnerability is rooted in the use of eval-like logic for dynamic value generation. Roundcube has addressed this by completely removing support for code evaluation in the LDAP autovalues option in versions 1.6.16 and 1.7.1. Exploitation requires the attacker to have at least low-privileged credentials (PR:L) and depends on specific LDAP configurations (AC:H).
Affected products
- Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1
Timeline
- 2026-05-24: patched: Versions 1.6.16 and 1.7.1 released.
- 2026-05-24: advisory: Vendor security advisory published.
- 2026-05-25: disclosed: CVE-2026-48844 published.
References
- https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862
- https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
- https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1