{
  "cveId": "CVE-2026-48848",
  "url": "https://patchblox.com/security/cve/CVE-2026-48848",
  "summary": "CVE-2026-48848 is fixed in roundcube on 1 platform, first by DEBIAN-CVE-2026-48848, released June 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "roundcube: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Casc...",
  "description": "Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.",
  "published": "2026-05-25T20:16:37Z",
  "severity": "high",
  "cvss": 7.2,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss": 0.00388,
  "epssPercentile": 0.33121,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.6.5\u002Bdfsg-1\u002Bdeb12u9",
      "fix": "DEBIAN-CVE-2026-48848",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48848",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.6.16\u002Bdfsg-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-48848",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48848",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Debian 14",
      "fixedVersion": "1.6.16\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-48848",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48848",
      "released": "2026-06-24T14:07:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}