Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-48849-Roundcube-Webmail-Stored-XSS — This repository documents CVE-2026-48849, a Stored Cross-Site Scripting (XSS), HTML Injection, and CSS Injection vulnerability discovered in Roundcube Webmai | Kitploit
Tools/GitHubGitHub/anandjogawade/cve-2026-48849-roundcube-webmail-stored-xss
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPapers & ResearchLearning & Education
GitHubanandjogawade/cve-2026-48849-roundcube-webmail-stored-xss

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

This repository documents CVE-2026-48849, a Stored Cross-Site Scripting (XSS), HTML Injection, and CSS Injection vulnerability discovered in Roundcube Webmai

View RepositoryWebsite
122 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-48849 - Stored XSS, HTML Injection & CSS Injection in Roundcube Webmail

Overview

This repository contains a Proof-of-Concept (PoC) for CVE-2026-48849, a Stored Cross-Site Scripting (XSS), HTML Injection, and CSS Injection vulnerability in Roundcube Webmail.

The vulnerability allows attacker-controlled HTML, CSS, and JavaScript injected through the email subject field to be stored within draft/session restoration data and automatically executed when the user logs back in and restores the session.

This repository is provided for educational and security research purposes only.

Vulnerability Details

FieldValue
CVECVE-2026-48849
ProductRoundcube Webmail
Vulnerability TypeStored XSS / HTML Injection / CSS Injection
Affected Versions1.6.x before 1.6.16, 1.7.x before 1.7.1
Fixed Versions1.6.16, 1.7.1
Found/Reported byAnand Jogawade (zazy)

Impact

Successful exploitation may allow:

  • Execution of arbitrary JavaScript in an authenticated user context
  • HTML content injection
  • CSS-based UI manipulation and visual defacement
  • Phishing-style overlays within the webmail interface
  • DOM manipulation
  • Redirection to attacker-controlled websites
  • Stored payload persistence until draft/session data is removed

A notable aspect of this vulnerability is that the payload executes automatically during the session restoration process after login, without requiring additional user interaction.

Reproduction Steps

  1. Login to Roundcube Webmail
  2. Click Compose.
  3. Insert the payload into the Subject field.
  4. Trigger any background action (e.g., attach image) and capture the request and send to repeater.
  5. Sent the original request first and render the response (it will show image).
  6. Then invalidate session by modifying or deleting roundcube_sessauth cookies in repeater and send it and render the response (it will show main login page).
  7. Confirm session expiration via sending same request with valid (original) cookies and check the response of 200ok (it will still show main login page).
  8. Check the right corner of Roundcube compose mail section it will show a message of "Your session is invalid or expired".
  9. Then reload the page (it will throw back to login page).
  10. Login again with same credentials.
  11. XSS alerts automatically and restore message popup with CSS injection and HTML injection.

Proof of Concept

root@kitploit:~
'"><script>alert("XSS")</script> <h1>HTML</h1><h2>Injection</h2> <b/style=position:fixed;top:0;left:0;font-size:200px>CSS Injection<!--

Tested On Version 1.5.9

POC-1

Tested On Version 1.16.15

POC-1

Stored XSS

POC-2

HTML + CSS Injection

POC-3

References

  • Roundcube Security Advisory
    https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1

  • Roundcube 1.6.16 Release
    https://github.com/roundcube/roundcubemail/releases/tag/1.6.16

  • Roundcube 1.7.1 Release
    https://github.com/roundcube/roundcubemail/releases/tag/1.7.1

  • Roundcube Changelog
    https://github.com/roundcube/roundcubemail/blob/master/CHANGELOG.md

  • SentinelOne CVE Entry
    https://www.sentinelone.com/vulnerability-database/cve-2026-48849/

Disclaimer

This Proof-of-Concept is intended solely for educational, research, and defensive security purposes. Testing should only be performed on systems you own or are authorized to assess.

Download Tool