Roundcube Webmail Pre-Auth SQL Injection in virtuser_query Plugin (CVE-2026-48842) — Patched in 1.6.16 / 1.7.1 Alongside 7 Other Vulnerabilities

Roundcube Webmail Pre-Auth SQL Injection in virtuser_query (TL-2026-0616), also tracked as Roundcube virtuser_query preg_replace SQLi, is a high-severity software vulnerability scored CVSS 8.1, first published 2026-05-28. It has no confirmed attribution, affects Roundcube Roundcube Webmail, references 8 CVEs (CVE-2026-48842, CVE-2026-48843, CVE-2026-48844), maps to 22 MITRE ATT&CK techniques (T1027, T1048, T1059), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0616

Threat ID
TL-2026-0616
Also known as
Roundcube virtuser_query preg_replace SQLi, skull SQLi, Roundcube 1.6.16 / 1.7.1 May 2026 security release
Severity
HIGH
CVSS
8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-28
Last reviewed
2026-05-28
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
hosting-providers, telecom, government, education, healthcare, financial, managed-service-providers, small-and-medium-business
Target regions
Global, North America, Europe, Asia-Pacific, Latin America, Middle East, Africa
Detection rules
9
Indicators of compromise
20

Malware and tooling in Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

Malware and tooling: sqlmap - S0225

Roundcube Webmail 1.6.16 and 1.7.1 patch a pre-authentication SQL injection (CVE-2026-48842, CVSS 8.1) in the virtuser_query plugin, discovered by researcher 'skull'. The flaw allows unauthenticated attackers to bypass database escape protections by abusing preg_replace's interpretation of backslash sequences in the replacement string, enabling arbitrary SQL injection during the address-to-user lookup that happens before login. The same advisory bundles seven additional CVEs covering CSS/HTML sanitization bypasses (CVE-2026-48843, -48848), unsafe LDAP code evaluation (CVE-2026-48844), SSRF/remote-image-blocking bypasses (CVE-2026-48845, -48846), pre-auth arbitrary file deletion via Redis/Memcache session poisoning (CVE-2026-48847), and stored XSS in the draft restore dialog (CVE-2026-48849).

How Roundcube Webmail Pre-Auth SQL Injection in virtuser_query works

Roundcube Webmail is an open-source IMAP webmail client widely deployed across shared-hosting providers, enterprise mail farms, telecom operators, and government webmail portals; cPanel, Plesk, and ISPConfig all ship Roundcube by default, placing the codebase on hundreds of thousands of internet-exposed hosts. On 2026-05-24 the Roundcube project shipped releases 1.6.16 (LTS branch) and 1.7.1, addressing eight CVEs disclosed over the prior weeks. NVD published CVE assignments on 2026-05-25 and Cyber Security News issued a public writeup on 2026-05-28.

The headline vulnerability, CVE-2026-48842 (CVSS 8.1 / High, CWE-89), is a pre-authentication SQL injection in the optional virtuser_query plugin, which is used by Roundcube deployments that map between physical mail-store usernames and external SMTP/IMAP addresses. The plugin exposes four lookup paths — user2email, email2user, user2host, and alias2user — all of which interpolate user-controlled values into a configurable SQL query template such as `SELECT email FROM virtuser WHERE user='%u'`. The pre-patch code wrapped the lookup parameter with the database driver escape function, then substituted it into the template via `preg_replace('/%u/', $dbh->escape($p['user']), $this->config['email'])`. This is the bug: PHP's preg_replace treats the replacement string as a pattern that can contain backreferences (`$0`, `\0`, `\1`...) and literal-backslash escapes (`\\` → `\`). When `$dbh->escape()` doubled a backslash supplied by the attacker (turning `\` into `\\` to neutralize SQL string escaping), preg_replace collapsed those two backslashes back into one before placing them in the final SQL statement. The attacker therefore regains the ability to inject a literal backslash that escapes the trailing single-quote of the SQL string literal, breaking out of the quoted context and appending arbitrary SQL.

The vulnerable surfaces are reached by anonymous HTTP requests because the username and email parameters in virtuser_query are consulted before authentication, during pre-login address normalization. Attackers can therefore perform UNION-based extraction, error-based extraction, time-based blind extraction, or stacked queries (driver-dependent) to read mailbox metadata, Roundcube user records, IMAP credentials cached in `users` and `identities` tables, and any data co-located in the Roundcube database. On installations where the Roundcube database user has write access (the default), the attacker can also write or modify rows — enabling password resets, identity hijack, and follow-on authentication bypass.

The upstream fix replaces each of the four `preg_replace('/%u/', ...)` and `preg_replace('/%m/', ...)` calls with `str_replace('%u', ...)` / `str_replace('%m', ...)` in plugins/virtuser_query/virtuser_query.php; str_replace treats both haystack and replacement as literal strings with no backreference interpretation, so the database escape survives intact. Commit 3406183a9976e36f992d3468f37d0e2346526ee9 lands the patch on the 1.6 LTS branch, and 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b ports it forward to 1.7.

The same release closes seven additional issues that together expand the post-exploitation surface even where virtuser_query is not installed: CVE-2026-48843 (CVSS 7.2) is a CSS-injection bypass in the HTML sanitizer via the SVG `<animate attributeName="style">` element, allowing dynamic style mutation that escapes Roundcube's `cssparser`/style allowlist; CVE-2026-48844 (CVSS 7.5) removes unsafe code evaluation in the LDAP `autovalues` option that could permit code injection when administrators expose ldap_public_search; CVE-2026-48845 (CVSS 6.5) closes an SSRF/local-resource fetch bypass via specific local-address URLs reported by Orange Cyberdefense; CVE-2026-48846 (CVSS 6.5) fixes a remote-image-blocking bypass via CSS `var()` indirection that re-enables tracking pixels; CVE-2026-48847 (CVSS 3.7) is a pre-auth arbitrary file deletion through Redis/Memcache session poisoning; CVE-2026-48848 (CVSS 7.2) is an additional CSS sanitization gap; and CVE-2026-48849 (CVSS 4.4) is a stored XSS through an unsanitized subject field in the draft restore dialog.

No proof-of-concept code is publicly available at time of analysis, and no in-the-wild exploitation has been reported. However, Roundcube has a recent track record of post-disclosure weaponization: CVE-2025-49113 (the pre-auth deserialization-to-RCE chain documented in TL-2026-0130) was added to CISA KEV within weeks of disclosure and mass-scanned by botnets. The virtuser_query vulnerability is structurally simpler — it requires only HTTP access to the login endpoint and a plugin configuration that ships with many cPanel/Plesk and high-volume mail hosting templates — making rapid PoC release likely. The CVSS 8.1 (not 9.x) base score reflects only the AC:H qualifier, which NVD applied because exploitation depends on the virtuser_query plugin being enabled; in deployments where it is enabled, the practical exploitability is high.

Defenders should patch immediately to 1.6.16 or 1.7.1, audit whether virtuser_query is enabled (search for `virtuser_query` in `$config['plugins']` in main.inc.php), and, where update is delayed, disable the plugin or place the Roundcube web tier behind a WAF rule that rejects login-time form parameters containing backslash characters. Database telemetry, web access logs for `/?_task=login` (and the underlying address-lookup path), and IMAP/SMTP auth logs should be reviewed for the disclosure-to-now window. Operators of cPanel/Plesk shared hosting environments should treat this as a fleet-wide upgrade event because a single unpatched tenant exposes shared database infrastructure.

MITRE ATT&CK techniques used in TL-2026-0616

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1526 Cloud Service Discovery

Persistence

T1098 Account Manipulation; T1505 Server Software Component

Command and Control

T1102 Web Service

Credential Access

T1110 Brute Force; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Collection

T1114 Email Collection; T1213 Data from Information Repositories

Impact

T1485 Data Destruction; T1565 Data Manipulation

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

  • Roundcube — Roundcube Webmail
    Vulnerable versions: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; 1.6.6; 1.6.7; 1.6.8; 1.6.9
    Fixed in: 1.6.16; 1.7.1
  • cPanel — cpanel-roundcubemail RPM
    Vulnerable versions: builds bundling Roundcube < 1.6.16
    Fixed in: build that bundles Roundcube 1.6.16+
  • Plesk — Plesk Roundcube package
    Vulnerable versions: any Plesk distribution shipping Roundcube < 1.6.16 / < 1.7.1
    Fixed in: Plesk update bundling Roundcube 1.6.16 / 1.7.1
  • Debian — roundcube package
    Vulnerable versions: distribution roundcube packages built from upstream < 1.6.16 pending DSA
    Fixed in: DSA-pinned roundcube package once published

Remediation for Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

Patches

  • Roundcube 1.6.16 — commit 3406183a9976e36f992d3468f37d0e2346526ee9 (virtuser_query: preg_replace → str_replace in user2email/email2user/user2host/alias2user)
  • Roundcube 1.7.1 — commit 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b (1.7 branch forward-port of the same fix)
  • Distribution tracking: Debian DSA / Ubuntu USN / Red Hat RHSA / Alpine apk advisories for the roundcubemail package once published.
  • cPanel: ensure cpanel-roundcubemail RPM is upgraded to the 1.6.16-bundled build before re-enabling shared-hosting tenants.
  • Composer/PHAR deployments: bump roundcube/roundcubemail dependency constraint to ^1.6.16 || ^1.7.1 and run composer update.

Immediate actions

  • Upgrade to Roundcube Webmail 1.6.16 (1.6 LTS branch) or 1.7.1 (1.7 branch) — both ship the str_replace patch for virtuser_query and the other seven CVE fixes.
  • If patching is delayed, disable the virtuser_query plugin by removing it from $config['plugins'] in config/config.inc.php and restart php-fpm/apache.
  • Apply WAF / reverse-proxy rule blocking POST requests to the Roundcube login endpoint where the _user or _email parameter contains a literal backslash (\\) character.
  • Search Roundcube and database logs for anomalous SQL syntax errors or unexpected UNION/SELECT patterns originating from the address-lookup queries during the 2026-04-01 to patch-deploy window.
  • Audit the database account used by Roundcube (the dsnw / dsnr connection strings) — confirm it is restricted to the Roundcube schema and lacks FILE / xp_cmdshell-equivalent privileges.

Workarounds

  • Disable virtuser_query plugin in config/config.inc.php — eliminates the SQL-injection sinkhole entirely at the cost of disabling vanity-address / alias resolution.
  • Front Roundcube with mod_security or Cloudflare WAF rule rejecting requests with backslash in _user, _email, or _action parameters at the login screen.
  • Restrict Roundcube to authenticated VPN or SSO until patch is applied — pre-auth surface is the entire concern.
  • Set the Roundcube database role to read-only on tables outside roundcube schema to limit blast radius of any future SQLi in this codebase.

Longer-term hardening

  • Add Roundcube to the standard patch SLA tier reserved for pre-auth network-reachable webmail (sub-72h for High/Critical) given the project's history of post-disclosure weaponization (cf. CVE-2025-49113 / TL-2026-0130 CISA KEV).
  • Move Roundcube behind authenticating reverse proxies (SSO, mTLS, or geo/ASN allowlists) where business requirements permit, reducing the pre-auth attack surface that virtuser_query and similar plugins expose.
  • Segregate the Roundcube MySQL/PostgreSQL instance from shared databases so a SQLi compromise cannot pivot to billing, CRM, or hypervisor control planes — a common shared-hosting anti-pattern.
  • For shared-hosting and cPanel/Plesk operators: enroll Roundcube in fleet-wide unattended-upgrade automation (cpanel-roundcubemail, or vendor RPM channel) and instrument fleet inventory to alert on hosts running unpatched 1.5.x / 1.6.x / 1.7.x.
  • Stand up baseline detection content (Splunk SPL, Microsoft Sentinel KQL, Sigma) covering pre-login parameter tampering on Roundcube and other PHP webmail front-ends — see Detector phase output for this threat.

CVEs associated with Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

CVE-2026-48842, CVE-2026-48843, CVE-2026-48844, CVE-2026-48845, CVE-2026-48846, CVE-2026-48847, CVE-2026-48848, CVE-2026-48849

Weaknesses (CWE) in Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

CWE-89, CWE-79, CWE-94, CWE-918, CWE-73, CWE-116

Timeline of Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

  • Researcher 'skull' privately reports the virtuser_query preg_replace backslash-escape bypass to the Roundcube security team via security@roundcube.net (approximate window inferred from coordinated-disclosure cadence; exact date not yet published).
  • Independent disclosures arrive from Orange Cyberdefense Vulnerability Disclosure Team (SSRF / local URL fetch — later CVE-2026-48845), zazy (draft restore stored XSS — CVE-2026-48849), wooseokdotkim (SVG animate CSS injection — CVE-2026-48843), Geame (CSS var() remote-image bypass — CVE-2026-48846), valent1 (Redis/Memcache session poisoning file delete — CVE-2026-48847), and Glendaenri (LDAP autovalues code evaluation — CVE-2026-48844). Roundcube triages the batch toward a single coordinated release.
  • Roundcube ships 1.6.16 (1.6 LTS) and 1.7.1 (1.7 branch). Commit 3406183a9976 lands the str_replace fix for virtuser_query on the LTS branch; commit 87124cc7136a forward-ports to 1.7. Release notes published at roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1.
  • NVD publishes CVE-2026-48842 (CVSS 8.1, CWE-89) for the virtuser_query SQL injection along with CVE-2026-48843 through CVE-2026-48849 for the seven co-fixed issues.
  • Threadlinqs Intelligence opens TL-2026-0616 to track this disclosure; baseline detections built across Splunk / Sentinel / Sigma / CrowdStrike CQL for backslash-bearing login parameters and abnormal virtuser_query lookups.
  • Cyber Security News publishes the first widely-circulated public writeup of the Roundcube release at cybersecuritynews.com/roundcube-webmail-sql-vulnerability, summarizing the SQL injection and bundled fixes; no PoC yet released.
  • As of 2026-05-29, CVE-2026-48842 and its 7 bundled CVEs are patched in Roundcube 1.6.16/1.7.1 (2026-05-24), with no public PoC, no in-the-wild exploitation, and no CISA KEV listing yet. It remains a live concern because the pre-auth flaw is structurally simple, reaches huge cPanel/Plesk shared-hosting fleets, and Roundcube has a history of rapid post-disclosure weaponization, so unpatched hosts warrant monitoring.

Sources cited for Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

Threats related to Roundcube Webmail Pre-Auth SQL Injection in virtuser_query

Detection coverage for TL-2026-0616

As of 2026-05-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0616 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats