Is CVE-2026-48843 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48843 being exploited in the wild.

How severe is CVE-2026-48843?

High severity, with a CVSS score of 7.2, published 25 May 2026.

Which products and versions are affected?

Roundcube Webmail 1.6.14 to 1.6.16, 1.7.x before 1.7.1.

Is there a fix for CVE-2026-48843?

A patch was published on 2026-05-24: Security updates 1.6.16 and 1.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48843 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48843?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48843: Roundcube Webmail SSRF via insufficient CSS sanitization

CVE-2026-48843 · Severity: high · CVSS 7.2 · Published 2026-05-25

Roundcube Webmail, a widely used open-source web-based email client, contains a security flaw in how it processes email content. An attacker can send a specially crafted email that tricks the server into making unauthorized requests to internal network resources or leaking sensitive information. This could allow an attacker to probe private internal networks that are otherwise inaccessible from the internet.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-48843 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48843 being exploited in the wild.
How severe is CVE-2026-48843?: High severity, with a CVSS score of 7.2, published 25 May 2026.
Which products and versions are affected?: Roundcube Webmail 1.6.14 to 1.6.16, 1.7.x before 1.7.1.
Is there a fix for CVE-2026-48843?: A patch was published on 2026-05-24: Security updates 1.6.16 and 1.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48843 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48843?: Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Roundcube Webmail due to insufficient sanitization of Cascading Style Sheets (CSS) within HTML email messages. The vulnerability, which is an incomplete fix for a previous issue, allows an attacker to bypass security filters by using specific local address URLs in stylesheet links. By sending a malicious email, a remote attacker can force the webmail server to fetch resources from local network hosts or private IP addresses. This can lead to the disclosure of internal network information or unauthorized access to internal services. The issue is fixed in versions 1.6.16 and 1.7.1.

Affected products

Roundcube Roundcube Webmail 1.6.14 to 1.6.16, 1.7.x before 1.7.1

Timeline

2026-05-24: patched: Security updates 1.6.16 and 1.7.1 released
2026-05-25: disclosed: CVE-2026-48843 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.