CVE-2026-48842 — Roundcube Webmail Pre-Auth SQLi (virtuser_query)
Pre-authentication SQL injection in Roundcube Webmail via the virtuser_query plugin and a preg_replace() backslash escape bypass. Affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1 (CVSS 3.1 8.1 HIGH).
Description
Overview
CVE-2026-48842 is a pre-authentication SQL injection in Roundcube Webmail when the virtuser_query plugin is enabled. The flaw involves improper handling of backslash escaping in preg_replace(), allowing attacker-controlled username input on the login path to reach SQL built by the plugin (CWE-89).
Roundcube is a widely deployed browser-based IMAP client; many hosts expose it at paths such as /webmail/ or /roundcube/.
Affected versions
| Branch | Vulnerable | Fixed in | |--------|------------|----------| | 1.6.x | before 1.6.16 | 1.6.16 | | 1.7.x | before 1.7.1 | 1.7.1 |
Confirm your rcversion on the login page or upgrade to a patched release from the vendor.
Attack surface
- Vector: Network, no authentication required (login POST with crafted
_user/ related fields). - Plugin:
virtuser_query(virtual user mapping via SQL). - Complexity: CVSS attack complexity is High; exploitation still warrants urgent patching on internet-facing webmail.
Bundled PoC (check mode)
The member download is a Python 3 checker aligned with this CVE:
- Discovers Roundcube under common paths (
/roundcube/,/webmail/, etc.). - Parses rcversion and flags versions in the affected ranges.
- Optionally detects virtuser_query plugin presence.
- With
--verify, sends safe login probes (error-based / time-based signals) — use only on authorized targets.
Mass-scan flags (--list, threading) are for inventories you own or have written permission to test.
Impact
Successful SQL injection can lead to confidentiality, integrity, and availability impact on the mail platform database (credential theft, mail metadata access, or further chaining depending on DB privileges).
Remediation
- Upgrade to Roundcube 1.6.16 or 1.7.1 (or newer supported branch per Roundcube security news).
- If virtuser_query is unused, remove or disable the plugin until patched.
- Restrict webmail to VPN / allowlisted IPs where feasible.
- Review DB account privileges for the Roundcube application user (least privilege).
Legal and ethical use
Test only Roundcube instances you operate or are explicitly authorized to assess. Unauthorized SQL injection attempts against third-party mail servers are illegal in most jurisdictions.