{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/roundcube-webmail--1.7.0--1.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.4,"id":"CVE-2026-48849"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Roundcube Webmail (\u003c 1.6.16)","Roundcube Webmail (\u003e= 1.7.0, \u003c 1.7.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Roundcube"],"content_html":"\u003cp\u003eCVE-2026-48849 is a stored Cross-Site Scripting (XSS), HTML injection, and CSS injection vulnerability affecting Roundcube Webmail. The vulnerability resides in the handling of the email subject field during session restoration processes. An attacker can inject malicious payloads into an email subject; these payloads are stored within draft or session restoration data. When the targeted user logs back into the webmail interface, the stored payload executes automatically in the user's authenticated context.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts an email subject containing XSS, HTML, or CSS payloads.\u003c/li\u003e\n\u003cli\u003eAttacker logs into Roundcube Webmail and initiates a composition of a new message.\u003c/li\u003e\n\u003cli\u003eAttacker inputs the malicious payload into the \u0026quot;Subject\u0026quot; field.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a background action (e.g., image attachment) to store the draft data.\u003c/li\u003e\n\u003cli\u003eAttacker forces an invalidation or expiration of the session while the session restoration data is cached.\u003c/li\u003e\n\u003cli\u003eVictim logs back into the Roundcube interface using valid credentials.\u003c/li\u003e\n\u003cli\u003eRoundcube attempts to restore the previous session, triggering the execution of the injected payload from the subject field.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the victim's session, DOM manipulation, visual defacement via CSS injection, and the creation of phishing overlays within the webmail interface. Payloads persist within the user's draft or session restoration data until removed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Roundcube Webmail installations to version 1.6.16 or 1.7.1 immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous POST requests to mail composition or draft-saving endpoints containing script tags or HTML/CSS injection metacharacters.\u003c/li\u003e\n\u003cli\u003eMonitor webmail user activity for unexpected UI overlays or unusual script execution patterns following user logins.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T09:45:57Z","date_published":"2026-10-22T09:45:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-roundcube-xss/","summary":"CVE-2026-48849 is a stored XSS, HTML, and CSS injection vulnerability in Roundcube Webmail that enables malicious payload execution upon session restoration.","title":"Roundcube Webmail: Stored XSS and Injection (CVE-2026-48849)","url":"https://feed.craftedsignal.io/briefs/2026-10-roundcube-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Roundcube Webmail (\u003e= 1.7.0, \u003c 1.7.1)","version":"https://jsonfeed.org/version/1.1"}