CVE-2026-48844CWE-670

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection

High · published May 25, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2026-05-25T19:14Z
EPSS history
Timeline
  • 25 MAY 19:14Z
    Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection
    cvelistv5