Roundcube Webmail: Stored XSS and Injection (CVE-2026-48849)

CVE-2026-48849 is a stored Cross-Site Scripting (XSS), HTML injection, and CSS injection vulnerability affecting Roundcube Webmail. The vulnerability resides in the handling of the email subject field during session restoration processes. An attacker can inject malicious payloads into an email subject; these payloads are stored within draft or session restoration data. When the targeted user logs back into the webmail interface, the stored payload executes automatically in the user's authenticated context.

Attack Chain

1. Attacker crafts an email subject containing XSS, HTML, or CSS payloads.
2. Attacker logs into Roundcube Webmail and initiates a composition of a new message.
3. Attacker inputs the malicious payload into the "Subject" field.
4. Attacker triggers a background action (e.g., image attachment) to store the draft data.
5. Attacker forces an invalidation or expiration of the session while the session restoration data is cached.
6. Victim logs back into the Roundcube interface using valid credentials.
7. Roundcube attempts to restore the previous session, triggering the execution of the injected payload from the subject field.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the victim's session, DOM manipulation, visual defacement via CSS injection, and the creation of phishing overlays within the webmail interface. Payloads persist within the user's draft or session restoration data until removed.

Recommendation

• Upgrade all Roundcube Webmail installations to version 1.6.16 or 1.7.1 immediately.
• Review web server access logs for anomalous POST requests to mail composition or draft-saving endpoints containing script tags or HTML/CSS injection metacharacters.
• Monitor webmail user activity for unexpected UI overlays or unusual script execution patterns following user logins.