Back Linuxsecurity

Fedora 44 RoundcubeMail Critical SQL Injection XSS Issues 2026

Linuxsecurity •LinuxSecurity Advisories • June 3, 2026

Release 1.7.1 Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314) Managesieve: Fix error when a mail message contains duplicate List-Id header (#10186) Clarified Elastic installation instructions (#10163) Added HTMLFormElement.requestSubmit() polyfill for older browsers (#10179) Fix so "has:attachment" uses $HasAttachment/$HasNoAttachment keywords (#10168) Fix potential too long value in IMAP ID command (#10136) Fix redis/memcache disconnection in rcube::sleep() (#10127) Fix so static resources, e.g. skin_logo can be put inside the public_html directory (#10160) Fix so REQUEST_URI is used as a fallback if PATH_INFO is not set in static.php (#10181) Fix assets_path feature and remove dependency on PATH_INFO (#10185) Fix MySQL upgrade on MySQL 8.0 and MariaDB 10.5.3 (#10188) Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog Security: Fix CSS injection bypass in HTML sanitizer via SVG Se...

* Mon May 25 2026 Remi Collet - 1.7.1-1 - update to 1.7.1

[ 1 ] Bug #2481615 - CVE-2026-48842 roundcubemail: pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass [fedora-all] [ 2 ] Bug #2481617 - CVE-2026-48844 roundcubemail: code injection via insecure LDAP autovalues option [fedora-all] [ 3 ] Bug #2481619 - CVE-2026-48843 roundcubemail: information disclosure and Server-Side Request Forgery via insufficient CSS sanitization [fedora-all] [ 4 ] Bug #2481622 - CVE-2026-48845 roundcubemail: privilege escalation via remote image blocking bypass [fedora-all] [ 5 ] Bug #2481624 - CVE-2026-48848 roundcubemail: CSS injection via an SVG document that has an animate element with the attributeName attribute [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2b956d89d3' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection and XSS Vulnerabilities in RoundcubeMail Affect Fedora Users Recent updates to RoundcubeMail for Fedora 43 and 44 revealed critical vulnerabilities, including SQL injection and cross-site scripting (XSS) issues. CVE-2026-48842 details a pre-auth SQL injection in the virtuser_query plugin, while CVE-2026-48843 highlights insufficient CSS sanitization leading to information disclosure and server-side request forgery (SSRF). Other vulnerabilities include privilege escalation and code injection risks, with multiple CVEs published on May 25, 2026. Users of Fedora 43 and 44 are urged to apply the latest updates to mitigate these risks. The vulnerabilities could allow attackers to exploit email systems, potentially leading to unauthorized access and data breaches. The updates can be installed via the 'dnf' package manager. Security teams should prioritize patching to protect their systems from these vulnerabilities. 2 sources 74

Extracted Entities

Fedora 44 RoundcubeMail Critical SQL Injection XSS Issues 2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (5)

CWE Weaknesses (7)

Platforms (4)

Vulnerabilities (1)