Executive brief
Roundcube Webmail, a popular open-source web-based email client, is vulnerable to a security flaw in how it handles HTML email messages. An attacker can send a specially crafted email that forces the server to make unauthorized requests to internal network resources or disclose sensitive information. This could allow an attacker to probe private internal networks that are otherwise inaccessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Roundcube Webmail versions prior to 1.6.17 and 1.7.2. The issue stems from insufficient sanitization of Cascading Style Sheets (CSS) within HTML email messages, specifically failing to block stylesheet links pointing to local network hosts. An unauthenticated remote attacker can exploit this by sending a malicious HTML email containing crafted CSS URLs. Successful exploitation allows the attacker to perform internal network scanning or trigger unauthorized requests from the mail server. This vulnerability is a bypass of previous fixes for CVE-2026-35540 and CVE-2026-48843. Patches are available in versions 1.6.17 and 1.7.2.
Affected products
- Roundcube Webmail < 1.6.17, 1.7.x < 1.7.2
Timeline
- 2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
- 2026-07-14: disclosed: CVE-2026-62643 published
References
- https://github.com/roundcube/roundcubemail/commit/294c7da6e7284166f040cef8607b677d459e0786
- https://github.com/roundcube/roundcubemail/commit/6d69e094d55d3a9a84dfb36edf6ca985311f0c1c
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2