SQL injection in Roundcube
Roundcube is an open-source webmail application that allows users to access and manage email through a web browser. CVE-2026-48842 is a pre-authentication SQL injection vulnerability affecting Roundcube Webmail versions before 1.6.16 and 1.7.1. The flaw exists in the virtuser_query plugin and can be exploited remotely without authentication through a preg_replace() backslash escape bypass, potentially allowing attackers to manipulate database queries and compromise sensitive information.
