Critical Roundcube Webmail Security Updates Fix Severe Flaws

Roundcube Webmail issued urgent security updates for versions 1.6.16 and 1.7.1 that remediate multiple high-severity flaws — notably a pre-authentication SQL injection (CVE-2026-48842, CVSS 8.1), a code-evaluation/code-injection issue (CVE-2026-48844, CVSS 7.5), several XSS and sanitizer/CSS bypasses, session-poisoning enabling pre-auth file deletions, and SSRF bypasses — and recommends immediate patching to prevent remote exploitation.