The vulnerability CVE-2026-48848 affects Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 before 1.7. It arises from insufficient sanitization of HTML content, specifically allowing CSS injection via an SVG document that includes an animate element with the attributeName attribute. This can lead to Cross-site Scripting (XSS) attacks, potentially enabling an attacker to execute arbitrary code in the context of the victim's browser session. The CVSS 3.1 base score is 7.2, indicating a high-severity issue exploitable remotely without authentication or user interaction, with impacts on confidentiality and integrity and a changed security scope. Currently, there is no vendor-provided patch or official remediation level indicated.

Successful exploitation of this vulnerability could allow an attacker to inject malicious CSS code via crafted SVG content, leading to Cross-site Scripting (XSS). This may result in unauthorized disclosure of information or modification of data within the affected Roundcube Webmail environment. The vulnerability does not impact availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the Roundcube project for updates addressing this issue. Until a patch is available, consider restricting or sanitizing SVG content uploads or inputs if possible to reduce exposure.