CVE-2026-48847

LowCVSS 3.7

Published: 25/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allow pre-authentication arbitrary file deletion via Redis/Memcache session poisoning.

Risk Assessment

An unauthenticated attacker can delete critical server files, potentially causing service disruption or data loss.

Recommendation

Immediately upgrade to version 1.6.16 or 1.7.1.

Original NVD description (English source)

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.