PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48844 Roundcube CVE debrief

Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 contain an insecure code evaluation vulnerability in the LDAP autovalues configuration option. The autovalues feature allowed dynamic attribute generation through code evaluation, which could be exploited to inject and execute arbitrary code. The vulnerability has been resolved by completely removing support for code evaluation in the patched versions. This issue requires network access and low privileges but has high impact on confidentiality, integrity, and availability when exploited.

Vendor
Roundcube
Product
Webmail
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-05-26
Advisory published
2026-05-25
Advisory updated
2026-05-26

Who should care

Organizations running Roundcube Webmail with LDAP authentication enabled; system administrators managing email infrastructure; security teams responsible for webmail security posture; organizations with compliance requirements for input validation and code execution controls

Technical summary

The vulnerability exists in Roundcube's LDAP integration where the autovalues configuration option permitted PHP code evaluation to dynamically generate LDAP attribute values. This insecure implementation allowed attackers with low privileges and network access to inject malicious code through manipulated LDAP configurations or inputs. The attack complexity is rated high due to required conditions, but successful exploitation yields complete system compromise (high impact on CIA triad). The fix completely removes code evaluation support rather than attempting to sanitize inputs, eliminating the attack surface entirely.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Roundcube Webmail to version 1.6.16 (for 1.6.x branch) or 1.7.1 (for 1.7.x branch) or later
  • If immediate patching is not possible, review and disable LDAP autovalues configuration options that utilize code evaluation
  • Audit LDAP configuration files for any autovalues entries containing executable code patterns
  • Monitor application logs for suspicious LDAP-related activity or unexpected code execution
  • Restrict network access to Roundcube administrative interfaces to trusted sources only

Evidence notes

CVE published 2026-05-25; modified 2026-05-26. Vendor security advisory dated 2026-05-24. Patches released in versions 1.6.16 and 1.7.1. CVSS 3.1 vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-670 (Always-Incorrect Control Flow Implementation).

Official resources

2026-05-25