Executive brief
Roundcube Webmail, a popular open-source webmail suite, contains a security flaw in how it handles incoming HTML emails. Even when users have disabled the loading of remote content, an attacker can send a specially crafted email that forces the victim's web browser to make requests to internal network services or the local computer. This could allow an attacker to interact with private internal systems that are otherwise protected from the public internet.
Technical details
A vulnerability exists in Roundcube's HTML sanitization logic (rcube_washtml.php) where it fails to properly block local and private network URLs. While Roundcube typically blocks remote content to protect user privacy, it incorrectly allows URLs pointing to loopback (localhost), private IP ranges (RFC1918), link-local, and Unique Local Addresses (ULA). A remote attacker can exploit this by sending an HTML email; when the victim previews or opens the message, their browser will execute requests to these internal addresses. This effectively facilitates a client-side Server-Side Request Forgery (SSRF) or 'Same-Site' request bypass, potentially allowing interaction with internal services. The issue is fixed in versions 1.6.16 and 1.7.1.
Affected products
- Roundcube Roundcube Webmail < 1.6.16, < 1.7.1
Timeline
- 2026-05-24: patched: Fixed in versions 1.6.16 and 1.7.1
- 2026-05-28: disclosed: CVE published to NVD
References
- https://advisories.orangecyberdefense.com/advisories/163
- https://github.com/roundcube/roundcubemail/commit/7b52353653a67e6073b97d70eb94047132b78556
- https://github.com/roundcube/roundcubemail/commit/faf867432f51ebbe100382a70a9e3c042415ee1b
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.1