Roundcube Webmail CVE-2026-48845

The vulnerability requires that the Roundcube server perform server-side fetching of image URLs present in HTML email bodies - which occurs during normal HTML email processing in affected versions when the remote image blocking feature is active but the URL validation logic fails to classify local/private addresses as blocked destinations. The attacker must be able to deliver email to a user on the affected Roundcube instance. What limits exploitation: the attacker receives information indirectly (the server fetches the resource, not the attacker's browser), actual impact depends on what internal services are reachable from the Roundcube server's network position, and only versions 1.6.14-1.6.15 and 1.7.0 are affected. The CVSS PR:N confirms unauthenticated exploitation from the attacker's perspective - no account on the Roundcube instance is required.

The CVSS base score is 6.5 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting low attack complexity and no authentication requirement, but bounded confidentiality and integrity impact. This stands in notable tension with the SSVC assessment of Technical Impact: total, which likely accounts for the SSRF's potential to reach privileged internal services - such as cloud metadata endpoints (169.254.169.254) or internal management APIs - not otherwise externally accessible. EPSS at 0.03% (9th percentile) and SSVC Exploitation: none both confirm no current observed exploitation, consistent with the vulnerability being absent from CISA KEV. However, SSVC Automatable: yes is a meaningful signal: an attacker can send bulk emails to trigger server-side fetches at scale without user interaction. The realistic risk is deployment-dependent - for Roundcube instances hosted in cloud environments or alongside sensitive internal services, the impact ceiling substantially exceeds what C:L/I:L implies. For isolated deployments with no internal network exposure, the CVSS-implied medium risk is more representative.

An attacker sends a crafted HTML email to a Roundcube user with an embedded image tag pointing to an internal address such as http://169.254.169.254/latest/meta-data/ (AWS instance metadata) or an internal management console at an RFC 1918 address. When Roundcube processes the email server-side, it fetches the local URL despite remote image blocking being enabled, potentially leaking cloud credentials, internal API responses, or infrastructure details. No public exploit code exists, but given UI:N and AC:L, this is straightforward to reproduce from the description alone.