CVEvulnerability
CVE-2026-48848
7.2 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-05-25
- Last modified
- 2026-07-24
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774fb6d2643669a3c4d8a27 github.com
- https://github.com/roundcube/roundcubemail/commit/c960d102472dc579e15907d5bcdc3103a090ccf9 github.com
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 github.com
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 github.com
- https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 roundcube.net