In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored… (CVE-2026-48849)

CVE-2026-48849 affects Roundcube Webmail 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1. The issue arises from an unsanitized subject field in the draft restored value, which can be exploited to perform stored XSS and HTML/CSS injection attacks on shared mailboxes. This vulnerability allows an attacker with low privileges and requiring user interaction to inject malicious code that could affect confidentiality and integrity within the affected system.

Successful exploitation could lead to stored cross-site scripting and HTML/CSS injection, potentially allowing attackers to execute malicious scripts in the context of other users accessing shared mailboxes. The impact includes limited confidentiality and integrity loss but no availability impact is noted.

A fix is available in Roundcube Webmail versions 1.6.16 and 1.7.1 and later. Users should upgrade to these versions or later to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or if the issue is already mitigated in specific environments.