Roundcube SQLi (CVE-2026-48842) Exploited
Brief
Roundcube SQLi (CVE-2026-48842) Exploited
A pre-authentication SQL injection vulnerability in Roundcube Webmail is reportedly being exploited in the wild months after patches became available.
Tracked as CVE-2026-48842 , the flaw affects Roundcube’s virtuser_query plugin and was fixed in versions 1.
- 16 and 1.
- 1 on May 24, 2026. On September 21, the Canadian Centre for Cyber Security updated its advisory to state that open-source reporting indicated exploitation in the wild.
What Is CVE-2026-48842?
CVE-2026-48842 (CVSS 8.1) is a pre-authentication SQL injection vulnerability (classified as CWE-89) in Roundcube’s virtuser_query plugin, which performs database-backed mappings between usernames and email addresses.
Roundcube describes the root cause as a preg_replace() backslash-escape bypass.