# CVE-2026-48843: Roundcube Webmail SSRF via insufficient CSS sanitization

Source: https://junglewise.ai/threats/cve-2026-48843-roundcube-webmail-ssrf-via-insufficient-css-sanitization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-48843 · Severity: high · CVSS 7.2 · Published 2026-05-25

Roundcube Webmail, a widely used open-source web-based email client, contains a security flaw in how it processes email content. An attacker can send a specially crafted email that tricks the server into making unauthorized requests to internal network resources or leaking sensitive information. This could allow an attacker to probe private internal networks that are otherwise inaccessible from the internet.

Technologies: [Roundcube Webmail](https://junglewise.ai/threats/technologies/webmail). Vendors: [Roundcube](https://junglewise.ai/threats/vendors/roundcube).

## Quick answers

**Is CVE-2026-48843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48843 being exploited in the wild.

**How severe is CVE-2026-48843?** High severity, with a CVSS score of 7.2, published 25 May 2026.

**Which products and versions are affected?** Roundcube Webmail 1.6.14 to 1.6.16, 1.7.x before 1.7.1.

**Is there a fix for CVE-2026-48843?** A patch was published on 2026-05-24: Security updates 1.6.16 and 1.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48843 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48843?** Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Roundcube Webmail due to insufficient sanitization of Cascading Style Sheets (CSS) within HTML email messages. The vulnerability, which is an incomplete fix for a previous issue, allows an attacker to bypass security filters by using specific local address URLs in stylesheet links. By sending a malicious email, a remote attacker can force the webmail server to fetch resources from local network hosts or private IP addresses. This can lead to the disclosure of internal network information or unauthorized access to internal services. The issue is fixed in versions 1.6.16 and 1.7.1.

## Affected products

- Roundcube Roundcube Webmail 1.6.14 to 1.6.16, 1.7.x before 1.7.1

## Timeline

- 2026-05-24: patched: Security updates 1.6.16 and 1.7.1 released
- 2026-05-25: disclosed: CVE-2026-48843 published

## References

- [https://github.com/roundcube/roundcubemail/commit/ab96c88bfd888866ec5e02190b19618db283923a](https://github.com/roundcube/roundcubemail/commit/ab96c88bfd888866ec5e02190b19618db283923a)
- [https://github.com/roundcube/roundcubemail/commit/cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1](https://github.com/roundcube/roundcubemail/commit/cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.6.16](https://github.com/roundcube/roundcubemail/releases/tag/1.6.16)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.7.1](https://github.com/roundcube/roundcubemail/releases/tag/1.7.1)
- [https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1](https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1)

## Related threats

- [Roundcube Webmail IMAP command injection in message cache](https://junglewise.ai/threats/cve-2026-126813-roundcube-webmail-before-1-6-21-and-1-7-x-before-1-7-6-contains)
- [Roundcube Webmail stored XSS in draft restore dialog subject field](https://junglewise.ai/threats/cve-2026-48849-roundcube-webmail-stored-xss-in-draft-restore-dialog-subject)
- [Roundcube Webmail remote image blocking bypass via CSS var()](https://junglewise.ai/threats/cve-2026-48846-roundcube-webmail-remote-image-blocking-bypass-via-css-var)
- [Roundcube Webmail SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2021-44026-roundcube-webmail-sql-injection-vulnerability)
- [Roundcube Webmail Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-12641-roundcube-webmail-remote-code-execution-vulnerability)