Loading vulnerability…
Roundcube Webmail remote image blocking SSRF bypass
CVE-2026-48845 affects Roundcube Webmail 1.6.x from 1.6.14 through 1.6.15 and 1.7.x before 1.7.1. Roundcube did not properly honor remote image blocking when a text/html email referenced URLs that resolved to local or private destinations. As a result, an attacker could craft an HTML email that causes Roundcube to fetch resources from unauthorized local or internal network locations despite the intended remote image restrictions. The issue is described by Roundcube and downstream advisories as an SSRF bypass involving unauthorized local URL fetches and bypasses of remote image restrictions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause the Roundcube server or associated backend environment to make unauthorized requests to local or private network resources. This may disclose information reachable only from the server-side network context and, depending on what internal services are exposed and how fetched content is processed or used, may also contribute to privilege escalation. The primary documented impacts are information disclosure and possible privilege escalation via a malicious HTML email message.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling HTML email rendering or remote image loading where operationally feasible, and restrict the Roundcube host's outbound access to localhost, link-local, RFC1918, and other internal-only destinations using network egress controls. However, no vendor-provided workaround was cited; upgrading is the recommended mitigation.
Patch, then assume compromise.
Upgrade Roundcube Webmail to a fixed release: 1.6.16 or later on the 1.6.x branch, or 1.7.1 or later on the 1.7.x branch. Debian specifically shipped fixes in 1.6.5+dfsg-1+deb12u9 for bookworm and 1.6.16+dfsg-0+deb13u1 for trixie.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.