Roundcube Webmail versions prior to 1.6.16 and 1.7.1 contain a vulnerability (CVE-2026-48847) that permits pre-authentication arbitrary file deletion through session poisoning attacks targeting redis or memcache session stores. This vulnerability is categorized as CWE-669, indicating improper handling of resource transfer boundaries. The CVSS 3.1 base score is 3.7, with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on availability only. No known exploits are reported in the wild, and no official patch or remediation guidance has been published by the vendor.

An attacker can delete arbitrary files on the affected system without authentication by exploiting session poisoning in redis or memcache used by Roundcube Webmail. The impact is limited to availability (file deletion) with no direct confidentiality or integrity compromise reported. The low CVSS score reflects the high complexity of attack and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling redis/memcache session storage or restricting access to these services to trusted hosts only to reduce exposure. Monitor for vendor updates regarding patches or official mitigations.