What happened
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Affected versions
Webmail: 1.6.0 through before 1.6.16 (semver); 1.7.0 through before 1.7.1 (semver) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusProof-of-concept exploit for CVE-2026-48842. CVSS 8.1.Sploitus index2026-09-25T05:59:39+00:00Verifiedmurrez/CVE-2026-48842Pre-auth SQLi in Roundcube Webmail virtuser_query plugin via preg_replace backslash handling.murrez2026-09-25T06:01:35VerifiedSploitusProof-of-concept exploit for CVE-2026-48842. CVSS 8.1.Sploitus index2026-09-27T11:26:19+00:00Candidate4minx/CVE-2026-48842Pre-auth SQL injection in Roundcube Webmail virtuser_query plugin allows database reading.4minx2026-09-27T11:31:54VerifiedSploitusSQL injection in Roundcube.XsanFlip2026-10-03T10:00:44CandidateXsanFlip/POC-CVE-2026-48842SQL injection in Roundcube.XsanFlip2026-10-03T10:00:44CandidateSource timeline
CVE record published by NVDView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.