🟠High: Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
-
The Canadian Centre for Cyber Security has issued a warning about a Roundcube Webmail vulnerability that has been patched but is now being actively exploited in the wild.
The flaw is tracked as CVE-2026-48842 with a CVSS score of 8.1. It is a pre-authentication SQL injection in the virtuser_query plugin, affecting:
- Roundcube Webmail 1.6.x before 1.6.16
- Roundcube Webmail 1.7.x before 1.7.1
The issue stems from a
preg_replace()backslash problem in the plugin's handling, which enables the injection before authentication occurs. Since the vulnerability can be triggered without valid credentials, any exposed instance running an affected version should be considered at risk.If you run Roundcube, verify your version and upgrade to 1.6.16, 1.7.1, or a later release as soon as possible. Given that exploitation is confirmed in the wild, patching should be treated as urgent, and administrators should review logs for signs of suspicious requests to the virtuser_query endpoint.
Source: The Hacker News
Has your organization already patched Roundcube, or are you still assessing exposure?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login