Attackers Exploit Unauthenticated SQL Injection in Roundcube Webmail
Summary
Canada’s Cyber Centre warns that attackers are exploiting CVE-2026-48842, an unauthenticated SQL injection in Roundcube’s virtuser_query plugin. Fixed versions are 1.6.16 and 1.7.1; the number of vulnerable servers is unknown.
Key points
- CVE-2026-48842 is an unauthenticated SQL injection in Roundcube’s virtuser_query plugin, rated CVSS 8.1.
- Crafted backslash sequences can bypass the plugin’s preg_replace() escaping and inject quote characters into SQL queries.
- Roundcube fixed the flaw in versions 1.6.16 and 1.7.1, released in late May.
- Canada’s Cyber Centre says open-source reporting indicates exploitation in the wild but provided no details about observed attacks.
- Successful exploitation could enable database tampering and access to protected information, user identities, messages, and address books, according to a security lead cited in the article.
- Shadowserver data cited in the article shows over 500,000 Roundcube servers are internet-accessible; how many are vulnerable is unknown.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- High; CVSS 8.1
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available