Back Linuxsecurity

Fedora 43 Roundcube Webmail Important XSS SQL Issues 2026

Linuxsecurity •LinuxSecurity Advisories • June 4, 2026

Release 1.6.16 Fix potential too long value in IMAP ID command (#10136) Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog Security: Fix CSS injection bypass in HTML sanitizer via SVG Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass Security: Fix SSRF bypass via specific local address URLs Security: Fix bypass of remote image blocking via CSS var() Security: Fix local/private URL fetch bypass when remote resources were not allowed Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option

* Mon May 25 2026 Remi Collet - 1.6.16-1 - update to 1.6.16

[ 1 ] Bug #2481615 - CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [fedora-all] [ 2 ] Bug #2481617 - CVE-2026-48844 roundcubemail: code injection via insecure LDAP autovalues option [fedora-all] [ 3 ] Bug #2481619 - CVE-2026-48843 roundcubemail: information disclosure and Server-Side Request Forgery via insufficient CSS sanitization [fedora-all] [ 4 ] Bug #2481622 - CVE-2026-48845 roundcubemail: privilege escalation via remote image blocking bypass [fedora-all] [ 5 ] Bug #2481624 - CVE-2026-48848 roundcubemail: CSS injection via an SVG document that has an animate element with the attributeName attribute [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-07ee097ffe' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection and XSS Vulnerabilities in RoundcubeMail Affect Fedora Users Recent updates to RoundcubeMail for Fedora 43 and 44 revealed critical vulnerabilities, including SQL injection and cross-site scripting (XSS) issues. CVE-2026-48842 details a pre-auth SQL injection in the virtuser_query plugin, while CVE-2026-48843 highlights insufficient CSS sanitization leading to information disclosure and server-side request forgery (SSRF). Other vulnerabilities include privilege escalation and code injection risks, with multiple CVEs published on May 25, 2026. Users of Fedora 43 and 44 are urged to apply the latest updates to mitigate these risks. The vulnerabilities could allow attackers to exploit email systems, potentially leading to unauthorized access and data breaches. The updates can be installed via the 'dnf' package manager. Security teams should prioritize patching to protect their systems from these vulnerabilities. 2 sources 74

Extracted Entities

Fedora 43 Roundcube Webmail Important XSS SQL Issues 2026

The full story

Extracted Entities

Attack Types (5)

CVEs (5)

CWE Weaknesses (6)

MITRE ATT&CK (1)