CVE-2026-48844: Roundcube Webmail RCE Vulnerability

CVE-2026-48844 Overview

CVE-2026-48844 is a code injection vulnerability in Roundcube Webmail affecting versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The flaw resides in the Lightweight Directory Access Protocol (LDAP) autovalues option, which used PHP eval() to compute attribute values during new record creation. An attacker with the ability to influence LDAP attribute inputs can inject arbitrary PHP code into the evaluated expression. The Roundcube maintainers removed code evaluation support entirely in 1.6.16 and 1.7.1 rather than patching the unsafe construct. The issue is tracked under CWE-670 (Always-Incorrect Control Flow Implementation).

Critical Impact
Successful exploitation enables arbitrary PHP code execution within the Roundcube web application context, leading to compromise of confidentiality, integrity, and availability of the mail server.

Affected Products

Roundcube Webmail 1.6.x prior to 1.6.16
Roundcube Webmail 1.7.x prior to 1.7.1
Deployments using LDAP address books with the autovalues configuration option

Discovery Timeline

2026-05-24 - Roundcube publishes security updates 1.6.16 and 1.7.1
2026-05-25 - CVE-2026-48844 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-48844

Vulnerability Analysis

The vulnerability stems from the use of PHP eval() to process configurable templates in the LDAP address book module. When a new LDAP record is created, Roundcube iterates over the autovalues configuration array and, if a template contains a parenthesis character, treats the template as a PHP expression to be evaluated. The intent was to support snippets such as md5(microtime()) for auto-generated fields. Attribute values are passed through addslashes() before substitution, but escaping is not equivalent to sandboxing PHP code. An attacker who can influence the substituted attributes can break out of the intended expression and run arbitrary PHP. Exploitation requires authenticated access and an LDAP configuration that enables autovalues with parenthesized templates, which raises attack complexity but does not prevent abuse.

Root Cause

The root cause is the unsafe execution path in program/lib/Roundcube/rcube_ldap.php. The function checks whether a template string contains (, and if so, substitutes attribute values and calls eval("return ($code);"). Reliance on addslashes() and placeholder regex substitution is insufficient to prevent injection of PHP syntax.

Attack Vector

The attack vector is the network, targeting the Roundcube web application. An authenticated user, or an attacker controlling LDAP attribute content used as placeholders in autovalues, can craft input that escapes the evaluated expression. The condition is triggered when a new LDAP record is created and an autovalues template containing ( is processed.

php

// Vulnerable pattern in program/lib/Roundcube/rcube_ldap.php (pre-patch)
foreach ($this->prop['autovalues'] as $lf => $templ) {
    if (empty($attrs[$lf])) {
        if (str_contains($templ, '(')) {
            // replace {attr} placeholders with (escaped!) attribute values to be safely eval'd
            $code = preg_replace('/\{\w+\}/', '', strtr($templ, array_map('addslashes', $attrvals)));
            $res = false;
            try {
                $res = eval("return ({$code});");
            } catch (\ParseError $e) {
                // ignore
            }
            // ...
            $attrs[$lf] = $res;
        }
    }
}
// Source: https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862

Detection Methods for CVE-2026-48844

Indicators of Compromise

Unexpected PHP processes spawned by the Roundcube web server user, particularly child processes invoking shells or network utilities
Modifications to files under the Roundcube installation directory such as program/lib/Roundcube/ or config/ that do not match the deployed release
Error log entries containing Expression parse error on: originating from rcube_ldap.php, indicating attempted abuse of the eval() path
Anomalous outbound connections from the webmail host immediately following LDAP address book write operations

Detection Strategies

Inventory all Roundcube installations and identify hosts running 1.6.x below 1.6.16 or 1.7.x below 1.7.1
Audit Roundcube configuration files for non-empty autovalues entries containing the ( character, which indicate the vulnerable code path is reachable
Review web server access logs for POST requests to address book create endpoints correlated with the user accounts permitted to write LDAP records
Enable PHP error logging and alert on ParseError or raise_error messages emitted from the LDAP module

Monitoring Recommendations

Monitor the Roundcube application for unexpected file writes, new PHP files, or modifications to webroot content
Forward web server, PHP-FPM, and Roundcube application logs to a central log platform and retain them for incident review
Track parent-child process relationships on the webmail host to surface command execution chains originating from the PHP runtime

How to Mitigate CVE-2026-48844

Immediate Actions Required

Upgrade Roundcube Webmail to 1.6.16 or 1.7.1, which remove the eval()-based code evaluation path entirely
Review LDAP address book configurations and remove any autovalues templates that rely on PHP expressions such as md5(microtime())
Restrict who can create or modify LDAP address book entries until upgrades are verified across all instances
Rotate credentials and inspect the webmail host for persistence if log review surfaces suspicious activity

Patch Information

The fix is delivered in Roundcube 1.6.16 and Roundcube 1.7.1. The relevant changes are in commits 6a777d7 and ea1798a. The patches remove the parenthesis-triggered eval() branch in program/lib/Roundcube/rcube_ldap.php and delete the documented eval() example from config/defaults.inc.php. See the Roundcube Security Updates Announcement for vendor guidance.

Workarounds

If patching is delayed, edit the Roundcube configuration and ensure no autovalues entry contains a ( character, which prevents the vulnerable branch from being reached
Disable LDAP address book write operations for end users by adjusting role-based permissions in the LDAP backend
Place the Roundcube application behind a web application firewall and restrict access to authenticated administrative networks where feasible

bash

# Configuration example - sanitize autovalues to avoid the eval() branch
# In config/config.inc.php, ensure templates contain no parentheses:
$config['ldap_public']['example']['autovalues'] = [
    'mail' => '{givenname}.{sn}@example.com',
    // Do NOT use entries like: 'uid' => 'md5(microtime())'
];