Executive brief
Roundcube Webmail, a widely used open-source web-based email client, contains a security flaw in how it processes email content. An attacker can send a specially crafted email that tricks the server into making unauthorized requests to internal network resources or leaking sensitive information. This could allow an attacker to probe private internal networks that are otherwise inaccessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Roundcube Webmail due to insufficient sanitization of Cascading Style Sheets (CSS) within HTML email messages. The vulnerability, which is an incomplete fix for a previous issue, allows an attacker to bypass security filters by using specific local address URLs in stylesheet links. By sending a malicious email, a remote attacker can force the webmail server to fetch resources from local network hosts or private IP addresses. This can lead to the disclosure of internal network information or unauthorized access to internal services. The issue is fixed in versions 1.6.16 and 1.7.1.
Affected products
- Roundcube Roundcube Webmail 1.6.14 to 1.6.16, 1.7.x before 1.7.1
Timeline
- 2026-05-24: patched: Security updates 1.6.16 and 1.7.1 released
- 2026-05-25: disclosed: CVE-2026-48843 published
References
- https://github.com/roundcube/roundcubemail/commit/ab96c88bfd888866ec5e02190b19618db283923a
- https://github.com/roundcube/roundcubemail/commit/cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
- https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1