Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-48842
By Roy Kalfon |
26 September 2026
CVE-2026-48842 – Roundcube Webmail virtuser_query plugin SQL injection enables unauthenticated database compromise
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has pre-auth SQL injection in the virtuser_query plugin via a preg_replace() backslash-escape bypass. Remote attackers can inject arbitrary SQL without authentication to read/modify backend data, exposing stored messages and mail account credentials. Upgrade to 1.6.16/1.7.1 to mitigate.