DEBIAN-CVE-2026-48848
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-48848
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48848.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-48848
- Upstream
- Published
- 2026-05-25T20:16:37Z
- Modified
- 2026-09-14T17:03:16Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.
- References
Affected packages
Debian:12 / roundcube
Package
- Name
- roundcube
- Purl
- pkg:deb/debian/roundcube?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.6.5+dfsg-1+deb12u9
Affected versions
1.*
1.6.1+dfsg-1
1.6.2+dfsg-1
1.6.3+dfsg-1~deb12u1
1.6.3+dfsg-1
1.6.3+dfsg-2
1.6.4+dfsg-1~deb12u1
1.6.4+dfsg-1
1.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1
1.6.5+dfsg-1+deb12u2
1.6.5+dfsg-1+deb12u3
1.6.5+dfsg-1+deb12u4
1.6.5+dfsg-1+deb12u5
1.6.5+dfsg-1+deb12u6
1.6.5+dfsg-1+deb12u7
1.6.5+dfsg-1+deb12u8
Debian:13 / roundcube
Package
- Name
- roundcube
- Purl
- pkg:deb/debian/roundcube?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.6.16+dfsg-0+deb13u1
Debian:14 / roundcube
Package
- Name
- roundcube
- Purl
- pkg:deb/debian/roundcube?arch=source&distro=forky