Roundcube Webmail EUVD-2026-31718

The Roundcube server must have the HTML email rendering pipeline active (default behavior) and have network reachability from its PHP runtime to the internal target the attacker wishes to probe - exploitation requires the victim user to open or preview the malicious HTML email in the Roundcube interface so the server-side stylesheet fetcher executes. CVSS PR:N indicates the attacker does not need a Roundcube account to send the triggering email, but UI:N notwithstanding, practical exploitation depends on a user previewing the message; effectiveness is also limited if the operator has already disabled remote resource fetching in Roundcube settings, in which case only the 'local/private URL fetch bypass when remote resources were not allowed' variant (also fixed in 1.7.1) applies.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2 High) reflects a network-reachable, unauthenticated trigger with changed scope and low confidentiality/integrity impact - appropriate for an SSRF where the attacker pivots from the email subsystem to internal services. SSVC concurs that exploitation is 'none' observed, 'automatable: yes', with 'partial' technical impact, and the EPSS probability of 0.03% (9th percentile) aligns with the absence of known weaponization. The vulnerability is not on the CISA KEV list and no public exploit identified at time of analysis, but the combination of unauthenticated network vector, scope change, and Roundcube's large install base on shared hosting and SUSE/Debian distros means defenders should treat this as a real priority rather than a paper-only High - particularly in environments where the webmail host has access to cloud metadata services (169.254.169.254) or internal admin panels.

An attacker emails a Roundcube user an HTML message containing a crafted <link rel='stylesheet'> or @import referencing http://169.254.169.254/latest/meta-data/ or an internal admin URL such as http://10.0.0.5/admin. When the recipient opens or previews the message, the Roundcube server fetches the URL on the attacker's behalf, returning content or timing/response signals that disclose internal network topology, cloud IAM credentials, or service banners. No public exploit identified at time of analysis, but the bypass class (SSRF via CSS) is well-documented and the fix commits in the public GitHub repository may guide reverse engineering.