CVE-2026-48842: Roundcube Webmail SQLi Vulnerability

CVE-2026-48842 Overview

CVE-2026-48842 is a pre-authentication SQL injection vulnerability in Roundcube Webmail affecting versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The flaw resides in the virtuser_query plugin, where a preg_replace() backslash escape bypass allows attackers to inject arbitrary SQL statements without authentication. Successful exploitation can compromise the confidentiality, integrity, and availability of the underlying database. Roundcube addressed the issue in releases 1.6.16 and 1.7.1, published on May 24, 2026.

Critical Impact

Unauthenticated attackers can inject SQL into Roundcube's database backend through the virtuser_query plugin, potentially exposing mail account credentials and stored messages.

Affected Products

• Roundcube Webmail 1.6.x prior to 1.6.16
• Roundcube Webmail 1.7.x prior to 1.7.1
• Deployments using the virtuser_query plugin

Discovery Timeline

• 2026-05-24 - Roundcube publishes security updates 1.6.16 and 1.7.1
• 2026-05-25 - CVE-2026-48842 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-48842

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] reachable without authentication. Roundcube's virtuser_query plugin resolves email addresses to mailbox usernames by substituting user-supplied values into a configured SQL query template. The plugin attempts to neutralize injection attempts using preg_replace() with backslash escaping. Attackers can bypass that sanitization by crafting input containing backslash sequences that defeat the regex-based escape, allowing raw SQL fragments to reach the database driver. Because the affected code path is exercised during login or account lookup, no valid credentials are required to trigger it. The Roundcube team corrected the escape logic in commits 3406183a and 87124cc7.

Root Cause

The root cause is improper neutralization of special elements in an SQL command. The plugin relied on regular-expression escaping rather than parameterized queries. Backslash sequences in attacker-controlled input subverted the escape pass, leaving quote characters effective inside the constructed SQL statement.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker submits a malicious value to a Roundcube endpoint that invokes the virtuser_query lookup. The forged input traverses the flawed preg_replace() filter and is concatenated into the SQL string sent to the database.

No verified public proof-of-concept code is available. Technical specifics are documented in the upstream commits and the Roundcube Security Update Announcement.

Detection Methods for CVE-2026-48842

Indicators of Compromise

• Web server access logs containing backslash sequences, single quotes, or SQL keywords in parameters reaching Roundcube login or address-lookup endpoints
• Database query logs showing malformed or unexpected statements originating from the virtuser_query code path
• Unusual outbound traffic from the Roundcube host following anomalous login requests

Detection Strategies

• Inspect HTTP request bodies and query strings sent to Roundcube for SQL metacharacters combined with backslash escape sequences
• Correlate failed authentication attempts with database error responses to identify probing behavior
• Monitor for new or modified files in the Roundcube installation directory that could indicate post-exploitation activity

Monitoring Recommendations

• Enable verbose query logging on the database server backing Roundcube and forward logs to a central analytics platform
• Alert on web application firewall signatures matching union-based or boolean-based SQL injection patterns directed at Roundcube URLs
• Track Roundcube version strings across the estate to confirm patched builds are deployed

How to Mitigate CVE-2026-48842

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.6.16 or 1.7.1 without delay
• Audit the virtuser_query plugin configuration and disable it if unused
• Rotate database credentials used by the Roundcube application after patching if exploitation is suspected

Patch Information

Roundcube released fixed builds 1.6.16 and 1.7.1 on May 24, 2026. The corrective changes are visible in commits 3406183a and 87124cc7. Administrators should review the Roundcube Security Update Announcement for upgrade guidance.

Workarounds

• Disable the virtuser_query plugin in config/config.inc.php until patching is complete
• Place Roundcube behind a web application firewall with SQL injection rules tuned for backslash and quote bypass patterns
• Restrict the database account used by Roundcube to the minimum privileges required for mail operations

# Configuration example: disable virtuser_query plugin in config/config.inc.php
$config['plugins'] = array_diff($config['plugins'], ['virtuser_query']);