CVE-2026-48848

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

Score

CVSS 3.1 7.2 High

Status

Deferred - cve@mitre.org

Published

2026-05-25

Last modified

2026-05-26

Weaknesses

CWE-79

Affected products

• Webmail (Roundcube)

References

• https://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27
• https://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
• https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1