Loading vulnerability…
SSRF through insufficient CSS sanitization in Roundcube Webmail
Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 insufficiently sanitizes CSS in HTML email messages. Malicious embedded stylesheets or stylesheet links can cause server-side request forgery or information disclosure, including requests to local network hosts. The vulnerability results from incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can induce server-side requests to attacker-selected destinations, potentially including internal network services, and disclose information accessible through those requests. Remote code execution, privilege escalation, and cross-site scripting are not established consequences of this specific vulnerability.
If you can’t patch tonight, do this now.
No separate workaround is specified. Apply the applicable Roundcube vendor or distribution security updates.
Patch, then assume compromise.
Upgrade to Roundcube Webmail 1.6.18 or later on the 1.6 branch, or 1.7.3 or later on the 1.7 branch. Debian trixie provides the corresponding security update in 1.6.18+dfsg-0+deb13u1. Because subsequent CSS sanitization bypasses also affected these fixes, apply the latest available security updates rather than relying solely on these minimum versions. Debian bookworm received follow-up CSS sanitization fixes in 1.6.5+dfsg-1+deb12u12.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.