Search: CVE-2026-48848

CVE-2026-48848 is a high-severity vulnerability in Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7. It involves insufficient HTML sanitization that allows Cascading Style Sheets (CSS) injection through an SVG document containing an animate element with the attributeName attribute. This vulnerability is categorized as CWE-79, indicating improper neutralization of input during web page generation, commonly known as Cross-site Scripting (XSS).