# Roundcube Webmail Pre-Auth SQL Injection in virtuser_query Plugin (CVE-2026-48842) — Patched in 1.6.16 / 1.7.1 Alongside 7 Other Vulnerabilities

> Roundcube Webmail 1.6.16 and 1.7.1 patch a pre-authentication SQL injection (CVE-2026-48842, CVSS 8.1) in the virtuser_query plugin, discovered by researcher 'skull'. The flaw allows unauthenticated attackers to bypass database escape protections by abusing preg_replace's interpretation of backslash sequences in the replacement string, enabling arbitrary SQL injection during the address-to-user lookup that happens before login. The same advisory bundles seven additional CVEs covering CSS/HTML sanitization bypasses (CVE-2026-48843, -48848), unsafe LDAP code evaluation (CVE-2026-48844), SSRF/remote-image-blocking bypasses (CVE-2026-48845, -48846), pre-auth arbitrary file deletion via Redis/Memcache session poisoning (CVE-2026-48847), and stored XSS in the draft restore dialog (CVE-2026-48849).

- **Published:** 2026-05-28T00:00:00Z
- **Last reviewed:** 2026-09-28T01:20:03.794Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0616
- **ID:** TL-2026-0616
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48842, CVE-2026-48843, CVE-2026-48844, CVE-2026-48845, CVE-2026-48846, CVE-2026-48847, CVE-2026-48848, CVE-2026-48849

## Description

Roundcube Webmail is an open-source IMAP webmail client widely deployed across shared-hosting providers, enterprise mail farms, telecom operators, and government webmail portals; cPanel, Plesk, and ISPConfig all ship Roundcube by default, placing the codebase on hundreds of thousands of internet-exposed hosts. On 2026-05-24 the Roundcube project shipped releases 1.6.16 (LTS branch) and 1.7.1, addressing eight CVEs disclosed over the prior weeks. NVD published CVE assignments on 2026-05-25 and Cyber Security News issued a public writeup on 2026-05-28.

The headline vulnerability, CVE-2026-48842 (CVSS 8.1 / High, CWE-89), is a pre-authentication SQL injection in the optional virtuser_query plugin, which is used by Roundcube deployments that map between physical mail-store usernames and external SMTP/IMAP addresses. The plugin exposes four lookup paths — user2email, email2user, user2host, and alias2user — all of which interpolate user-controlled values into a configurable SQL query template such as `SELECT email FROM virtuser WHERE user='%u'`. The pre-patch code wrapped the lookup parameter with the database driver escape function, then substituted it into the template via `preg_replace('/%u/', $dbh->escape($p['user']), $this->config['email'])`. This is the bug: PHP's preg_replace treats the replacement string as a pattern that can contain backreferences (`$0`, `\0`, `\1`...) and literal-backslash escapes (`\\` → `\`). When `$dbh->escape()` doubled a backslash supplied by the attacker (turning `\` into `\\` to neutralize SQL string escaping), preg_replace collapsed those two backslashes back into one before placing them in the final SQL statement. The attacker therefore regains the ability to inject a literal backslash that escapes the trailing single-quote of the SQL string literal, breaking out of the quoted context and appending arbitrary SQL.

The vulnerable surfaces are reached by anonymous HTTP requests because the username and email parameters in virtuser_query are consulted before authentication, during pre-login address normalization. Attackers can therefore perform UNION-based extraction, error-based extraction, time-based blind extraction, or stacked queries (driver-dependent) to read mailbox metadata, Roundcube user records, IMAP credentials cached in `users` and `identities` tables, and any data co-located in the Roundcube database. On installations where the Roundcube database user has write access (the default), the attacker can also write or modify rows — enabling password resets, identity hijack, and follow-on authentication bypass.

The upstream fix replaces each of the four `preg_replace('/%u/', ...)` and `preg_replace('/%m/', ...)` calls with `str_replace('%u', ...)` / `str_replace('%m', ...)` in plugins/virtuser_query/virtuser_query.php; str_replace treats both haystack and replacement as literal strings with no backreference interpretation, so the database escape survives intact. Commit 3406183a9976e36f992d3468f37d0e2346526ee9 lands the patch on the 1.6 LTS branch, and 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b ports it forward to 1.7.

The same release closes seven additional issues that together expand the post-exploitation surface even where virtuser_query is not installed: CVE-2026-48843 (CVSS 7.2) is a CSS-injection bypass in the HTML sanitizer via the SVG `<animate attributeName="style">` element, allowing dynamic style mutation that escapes Roundcube's `cssparser`/style allowlist; CVE-2026-48844 (CVSS 7.5) removes unsafe code evaluation in the LDAP `autovalues` option that could permit code injection when administrators expose ldap_public_search; CVE-2026-48845 (CVSS 6.5) closes an SSRF/local-resource fetch bypass via specific local-address URLs reported by Orange Cyberdefense; CVE-2026-48846 (CVSS 6.5) fixes a remote-image-blocking bypass via CSS `var()` indirection that re-enables tracking pixels; CVE-2026-48847 (CVSS 3.7) is a pre-auth arbitrary file deletion through Redis/Memcache session poisoning; CVE-2026-48848 (CVSS 7.2) is an additional CSS sanitization gap; and CVE-2026-48849 (CVSS 4.4) is a stored XSS through an unsanitized subject field in the draft restore dialog.

No proof-of-concept code is publicly available at time of analysis, and no in-the-wild exploitation has been reported. However, Roundcube has a recent track record of post-disclosure weaponization: CVE-2025-49113 (the pre-auth deserialization-to-RCE chain documented in TL-2026-0130) was added to CISA KEV within weeks of disclosure and mass-scanned by botnets. The virtuser_query vulnerability is structurally simpler — it requires only HTTP access to the login endpoint and a plugin configuration that ships with many cPanel/Plesk and high-volume mail hosting templates — making rapid PoC release likely. The CVSS 8.1 (not 9.x) base score reflects only the AC:H qualifier, which NVD applied because exploitation depends on the virtuser_query plugin being enabled; in deployments where it is enabled, the practical exploitability is high.

Defenders should patch immediately to 1.6.16 or 1.7.1, audit whether virtuser_query is enabled (search for `virtuser_query` in `$config['plugins']` in main.inc.php), and, where update is delayed, disable the plugin or place the Roundcube web tier behind a WAF rule that rejects login-time form parameters containing backslash characters. Database telemetry, web access logs for `/?_task=login` (and the underlying address-lookup path), and IMAP/SMTP auth logs should be reviewed for the disclosure-to-now window. Operators of cPanel/Plesk shared hosting environments should treat this as a fleet-wide upgrade event because a single unpatched tenant exposes shared database infrastructure.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1098 Account Manipulation
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1526 Cloud Service Discovery
- T1082 System Information Discovery
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1565 Data Manipulation
- T1485 Data Destruction
- T1595.002 Active Scanning
- T1587.004 Develop Capabilities
- T1212 Exploitation for Credential Access
- T1087 Account Discovery
- T1565.001 Data Manipulation
- T1531 Account Access Removal
- T1588.006 Obtain Capabilities

## Sources

- [NVD — CVE-2026-48842](https://nvd.nist.gov/vuln/detail/CVE-2026-48842)
- [Roundcube Security Updates 1.6.16 and 1.7.1](https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1)
- [Roundcube 1.6.16 Release Notes (GitHub)](https://github.com/roundcube/roundcubemail/releases/tag/1.6.16)
- [Roundcube 1.7.1 Release Notes (GitHub)](https://github.com/roundcube/roundcubemail/releases/tag/1.7.1)
- [Fix Commit (1.6 LTS) — preg_replace → str_replace in virtuser_query](https://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9)
- [Fix Commit (1.7 branch forward-port)](https://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b)
- [Critical Roundcube Webmail Vulnerability Let Attackers Inject SQL Queries (Cyber Security News)](https://cybersecuritynews.com/roundcube-webmail-sql-vulnerability/)
- [NVD — CVE-2026-48843 (CSS sanitization SVG animate bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-48843)
- [NVD — CVE-2026-48844 (LDAP autovalues code evaluation)](https://nvd.nist.gov/vuln/detail/CVE-2026-48844)
- [NVD — CVE-2026-48845 (SSRF / local URL fetch bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-48845)
- [NVD — CVE-2026-48846 (remote image blocking CSS var() bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-48846)
- [NVD — CVE-2026-48847 (Redis/Memcache session poisoning arbitrary file delete)](https://nvd.nist.gov/vuln/detail/CVE-2026-48847)
- [NVD — CVE-2026-48848 (additional CSS sanitization gap)](https://nvd.nist.gov/vuln/detail/CVE-2026-48848)
- [NVD — CVE-2026-48849 (stored XSS in draft restore subject)](https://nvd.nist.gov/vuln/detail/CVE-2026-48849)
- [Roundcube virtuser_query plugin source (pre-patch reference)](https://github.com/roundcube/roundcubemail/blob/1.6.15/plugins/virtuser_query/virtuser_query.php)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0616