What is the CVSS score of CVE-2026-48843?

CVE-2026-48843 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Roundcube Webmail are affected by CVE-2026-48843?

Roundcube Webmail versions 1.6.14-1.6.15 and 1.7.0 contain a server-side request forgery vulnerability delivered through HTML email styling that enables attackers to access internal networks and…. A patch is available.

How to fix or mitigate CVE-2026-48843?

Within 24 hours: Identify all Roundcube instances and determine which versions are deployed. Within 7 days: Apply vendor patch to all instances running Roundcube 1.6.14-1.6.15 and 1.7.0. Within 30 days: Verify patch deployment is complete, audit mail gateway CSS filtering rules, and review server logs for indicators of attempted SSRF exploitation.

Roundcube Webmail CVE-2026-48843

EUVD-2026-31718 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-25 mitre

GHSA-2hww-8583-w9wf

Information Disclosure SSRF Webmail

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 10:26 vuln.today

Analysis Generated

Jun 08, 2026 - 10:26 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.

AnalysisAI

Server-Side Request Forgery and information disclosure in Roundcube Webmail 1.6.14-1.6.15 and 1.7.0 allows remote attackers to force the webmail server to fetch internal network resources by embedding malicious stylesheet links in HTML email messages. The flaw is a regression of CVE-2026-35540 caused by insufficient CSS sanitization, and while no public exploit identified at time of analysis, the EPSS score sits at a low 0.03% (9th percentile) despite the vulnerability being trivially triggerable by sending a crafted email.

Technical ContextAI

Roundcube is a widely deployed PHP-based IMAP webmail client whose HTML email rendering pipeline sanitizes incoming messages to neutralize active content. CWE-918 (Server-Side Request Forgery) applies here because the CSS sanitizer fails to fully strip or validate stylesheet link references in HTML messages, allowing URLs that point to internal hosts (RFC1918 ranges, localhost, cloud metadata endpoints) to be dereferenced by the server-side fetcher. The release notes for 1.7.1 (commit cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1 and ab96c88bfd888866ec5e02190b19618db283923a) explicitly cite an 'SSRF bypass via specific local address URLs' and a related 'local/private URL fetch bypass when remote resources were not allowed' reported by Orange Cyberdefense, indicating the previous CVE-2026-35540 blocklist was bypassable through alternative address encodings or CSS constructs.

RemediationAI

Vendor-released patch: upgrade to Roundcube Webmail 1.6.16 (https://github.com/roundcube/roundcubemail/releases/tag/1.6.16) for the 1.6.x branch or 1.7.1 (https://github.com/roundcube/roundcubemail/releases/tag/1.7.1) for the 1.7.x branch, per the advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1. The relevant fix commits are ab96c88bfd888866ec5e02190b19618db283923a and cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1. If patching is delayed, set the Roundcube configuration option to block remote resources in HTML messages (prevents the server-side fetcher from dereferencing stylesheet URLs at all, at the cost of breaking legitimate remote images and external CSS), and at the network layer restrict egress from the webmail PHP-FPM/Apache process to deny RFC1918, link-local 169.254.0.0/16, and loopback ranges - note this can break legitimate internal mail-relay or LDAP traffic and must be tested. SUSE-based deployments should track the distribution's security update channel for backported fixes.