# CVE-2026-48846: Roundcube Webmail remote image blocking bypass via CSS var()

Source: https://junglewise.ai/threats/cve-2026-48846-roundcube-webmail-remote-image-blocking-bypass-via-css-var  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-48846 · Severity: medium · CVSS 6.5 · Published 2026-05-25

Roundcube Webmail, a widely used open-source web-based email client, contains a vulnerability that allows attackers to bypass privacy protections. By sending a specially crafted email, an attacker can force the recipient's browser to load remote images even if the user has chosen to block them. This can be used to track when a user opens an email, potentially leaking their IP address and other metadata to the sender.

Technologies: [Roundcube Webmail](https://junglewise.ai/threats/technologies/webmail). Vendors: [Roundcube](https://junglewise.ai/threats/vendors/roundcube).

## Quick answers

**Is CVE-2026-48846 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48846 being exploited in the wild.

**How severe is CVE-2026-48846?** Medium severity, with a CVSS score of 6.5, published 25 May 2026.

**Which products and versions are affected?** Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1.

**Is there a fix for CVE-2026-48846?** A patch was published on 2026-05-24: Security updates 1.6.16 and 1.7.1 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48846 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48846?** Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Roundcube Webmail's HTML sanitizer allows for a bypass of the remote image blocking feature. The flaw exists in how the application handles CSS var() values within email messages. An attacker can craft an email containing specific CSS variables that reference external resources, which the sanitizer fails to properly neutralize. When a user views the email, the browser may fetch these remote resources automatically, leading to information disclosure (such as the user's IP address and user-agent) or potential access-control bypass. This issue is addressed in versions 1.6.16 and 1.7.1.

## Affected products

- Roundcube Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1

## Timeline

- 2026-05-24: patched: Security updates 1.6.16 and 1.7.1 released.
- 2026-05-25: disclosed: CVE-2026-48846 published.

## References

- [https://github.com/roundcube/roundcubemail/commit/59cca80908a61e662c5f81741449e9aeb91e8abe](https://github.com/roundcube/roundcubemail/commit/59cca80908a61e662c5f81741449e9aeb91e8abe)
- [https://github.com/roundcube/roundcubemail/commit/852350486b88b35b8544e8a630fad89e99e2150a](https://github.com/roundcube/roundcubemail/commit/852350486b88b35b8544e8a630fad89e99e2150a)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.6.16](https://github.com/roundcube/roundcubemail/releases/tag/1.6.16)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.7.1](https://github.com/roundcube/roundcubemail/releases/tag/1.7.1)
- [https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1](https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1)

## Related threats

- [Roundcube Webmail IMAP command injection in message cache](https://junglewise.ai/threats/cve-2026-126813-roundcube-webmail-before-1-6-21-and-1-7-x-before-1-7-6-contains)
- [Roundcube Webmail stored XSS in draft restore dialog subject field](https://junglewise.ai/threats/cve-2026-48849-roundcube-webmail-stored-xss-in-draft-restore-dialog-subject)
- [Roundcube Webmail SSRF via insufficient CSS sanitization](https://junglewise.ai/threats/cve-2026-48843-roundcube-webmail-ssrf-via-insufficient-css-sanitization)
- [Roundcube Webmail SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2021-44026-roundcube-webmail-sql-injection-vulnerability)
- [Roundcube Webmail Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-12641-roundcube-webmail-remote-code-execution-vulnerability)