Server-side request forgery (SSRF) affecting Roundcube Webmail
A vulnerability affecting Roundcube Webmail would allow an unauthenticated attacker to cause server-side request forgery (SSRF) and information disclosure on affected systems.
Description
Technical context and vulnerability details
Roundcube Webmail is a widely deployed open-source webmail client. This product is affected by a vulnerability labeled CVE-2026-62643 resulting from insufficient sanitization of CSS style sheets contained in electronic messages in HTML format. Exploitation of this vulnerability would allow an unauthenticated attacker to send a specially crafted email containing CSS links to internal hosts to cause server-side request forgery (SSRF) or information disclosure. It results from an incomplete correction of the CVE-2026-35540 and CVE-2026-48843 vulnerabilities. This vulnerability is classified as high with a severity score of 7.2 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Server-side request forgery (SSRF);
- Disclosure of internal network information;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Roundcube Webmail versions 1.6.0 to 1.6.16;
- Roundcube Webmail versions 1.7.0 to 1.7.1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Roundcube Webmail to versions 1.6.17 or 1.7.2 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.