EUVD-2026-60171
GHSA-vf28-qp34-hhm8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
UI:R because a recipient must open the email to trigger server-side CSS fetch; C:L added because the description explicitly confirms information disclosure as a realized impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
AnalysisAI
CSS sanitization bypass in Roundcube Webmail before 1.6.18 and 1.7.3 enables unauthenticated remote attackers to trigger server-side HTTP requests to RFC6598 shared address space (100.64.0.0/10) and IPv6 link-local addresses (fe80::/10) by embedding malicious stylesheet URLs in HTML email. This is the fourth iteration in a chain of incomplete SSRF fixes - following CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643 - with each prior fix failing to cover the full local address space, indicating a systemic gap in the blocklist-based sanitization approach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running Roundcube Webmail prior to version 1.6.18 (1.6.x branch) or 1.7.3 (1.7.x branch). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) scores 5.8 Medium, with the Scope:Changed metric being the most meaningful signal - confirming that exploitation crosses trust boundaries and allows the Roundcube server to reach internal hosts that attackers cannot directly access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a specially crafted HTML email to a target whose mailbox is hosted on a vulnerable Roundcube instance, embedding a CSS stylesheet URL pointing to an address in the 100.64.0.0/10 carrier-grade NAT range or fe80::/10 IPv6 link-local range. When the recipient opens or previews the message, Roundcube's server-side renderer processes the CSS reference, issues an HTTP request to the specified internal address, and potentially exposes service banners, metadata endpoints, or other data reachable at that address within the server's network context. … |
| Remediation | Upgrade Roundcube Webmail to version 1.6.18 for 1.6.x deployments or version 1.7.3 for 1.7.x deployments, as confirmed by vendor release tags and the security advisory at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today