CVE-2026-48848: Roundcube Webmail XSS Vulnerability

CVE-2026-48848 Overview

CVE-2026-48848 is a Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail caused by insufficient HTML sanitization [CWE-79]. The flaw allows attackers to perform Cascading Style Sheets (CSS) injection through a crafted Scalable Vector Graphics (SVG) document containing an animate element with the attributeName attribute. Roundcube versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 are affected. An attacker can deliver a malicious email containing the crafted SVG payload, and rendering the message triggers the injection without user interaction.

Critical Impact

A remote attacker can inject CSS via a malicious SVG in an email, manipulating the webmail interface and potentially exfiltrating sensitive information from rendered content.

Affected Products

• Roundcube Webmail 1.6.x prior to 1.6.16
• Roundcube Webmail 1.7.x prior to 1.7.1
• Self-hosted and shared-hosting Roundcube deployments using vulnerable releases

Discovery Timeline

• 2026-05-24 - Roundcube publishes security updates 1.6.16 and 1.7.1
• 2026-05-25 - CVE-2026-48848 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-48848

Vulnerability Analysis

The vulnerability resides in Roundcube's HTML sanitization layer, which is responsible for stripping dangerous markup from incoming email content before rendering it in the browser. The sanitizer fails to fully neutralize SVG animate elements that reference the attributeName attribute. An attacker can abuse this primitive to inject attacker-controlled CSS into the rendered message context.

CSS injection in a webmail context is more than a cosmetic issue. Attackers can overlay UI elements, alter link targets visually, exfiltrate data through CSS selectors and background image requests, and stage phishing content that appears to originate from the trusted webmail interface. The vulnerability is categorized under [CWE-79], Improper Neutralization of Input During Web Page Generation.

Root Cause

Roundcube's sanitizer did not adequately filter the attributeName attribute on SVG animate elements. SVG animation can dynamically modify other element attributes at render time, allowing a payload to mutate sanitized content into an active CSS injection vector. The patches in commits 58e5263f341e6a418774fb6d2643669a3c4d8a27 and c960d102472dc579e15907d5bcdc3103a090ccf9 tighten handling of these SVG constructs.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond opening or previewing a crafted email. An attacker sends an email containing an SVG document with an animate element whose attributeName value carries the injection payload. When Roundcube renders the message, the sanitizer permits the construct, and the browser applies the injected CSS within the webmail Document Object Model (DOM). The vulnerability mechanism is described in the Roundcube Security Updates Announcement and the upstream commits referenced below.

Detection Methods for CVE-2026-48848

Indicators of Compromise

• Inbound email messages containing SVG documents with <animate> elements referencing the attributeName attribute.
• Unexpected outbound HTTP requests from webmail sessions to attacker-controlled domains, consistent with CSS-based exfiltration.
• Roundcube application logs showing rendering of messages from untrusted senders with embedded SVG payloads.

Detection Strategies

• Inspect mail gateway content filters for SVG attachments and inline SVG elements containing animate tags with suspicious attributeName values.
• Audit Roundcube installations to confirm running versions are 1.6.16, 1.7.1, or later.
• Review web server access logs for anomalous referrers originating from authenticated webmail sessions.

Monitoring Recommendations

• Enable verbose logging on the Roundcube application server and forward logs to a central analytics platform.
• Monitor egress traffic from webmail hosts for connections to newly registered or low-reputation domains.
• Alert on email messages containing inline SVG with animation elements destined for high-value mailboxes.

How to Mitigate CVE-2026-48848

Immediate Actions Required

• Upgrade Roundcube Webmail to 1.6.16 or 1.7.1 immediately on all production servers.
• Inventory all Roundcube instances including those provisioned through shared hosting control panels.
• Notify users to avoid opening unexpected messages from unknown senders until patching completes.

Patch Information

Roundcube released fixed versions on 2026-05-24. Apply Roundcube 1.6.16 for the 1.6.x branch or Roundcube 1.7.1 for the 1.7.x branch. The corrective changes are in commits 58e5263f and c960d102.

Workarounds

• Configure mail gateways to strip or quarantine inline SVG content in HTML email bodies until patches are deployed.
• Restrict Roundcube access to authenticated users on trusted networks via VPN or IP allowlists.
• Enforce a strict Content Security Policy (CSP) on the Roundcube web interface to limit external resource loading.

# Configuration example: upgrade Roundcube via composer
cd /var/www/roundcube
composer require roundcube/roundcubemail:1.6.16
php bin/update.sh
systemctl restart php-fpm nginx