CVE-2026-48844

Katalog CVE

CVSS 7.5 · High EPSS 0,51%

Kerentanan Always-Incorrect Control Flow Implementation. Skor CVSS 3.1 7.5 (High) menurut mitre.org.

Deskripsi (NVD)

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

Rincian

Terbit di NVD

25 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/roundcube/roundcubemail/commit/6a777d7394b763ce9acfce86c1a521e14a02d862
• https://github.com/roundcube/roundcubemail/commit/ea1798a6fbf060abcc0ba73b2435036bf8016a5a
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
• https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1