What is the CVSS score of EUVD-2026-43749?

EUVD-2026-43749 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Roundcube Webmail are affected by EUVD-2026-43749?

Roundcube Webmail versions prior to 1.6.17 and 1.7.2 contain a critical Server-Side Request Forgery vulnerability enabling attackers to manipulate mail servers into accessing internal network…. A patch is available.

How to fix or mitigate EUVD-2026-43749?

Within 24 hours, identify all Roundcube Webmail instances running versions 1.6.x before 1.6.17 or 1.7.x before 1.7.2 and assess network segmentation around affected mail servers. Within 7 days, apply vendor-released patch Roundcube 1.6.17 (for 1.6.x deployments) or 1.7.2 (for 1.7.x deployments) to all identified instances after validation in a staging environment. Within 30 days, complete network access control audit of mail server systems, perform log analysis to identify any exploitation attempts, and confirm patch deployment across the complete inventory.

Roundcube Webmail EUVD-2026-43749

| CVE-2026-62643 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-14 mitre

GHSA-5q79-cfqm-5cxh

Information Disclosure SSRF Roundcube Webmail Suse

10.0

CVSS 3.1 · NVD

Severity by source

Vendor (mitre) PRIMARY

HIGH

qualitative

NVD

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

4.7 MEDIUM

Attacker sends email so PR:N, but the victim must render the crafted HTML (UI:R); SSRF crosses into other systems (S:C) yielding limited info disclosure (C:L) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 13:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 12:52 vuln.today

cvss_changed

Severity Changed

Jul 20, 2026 - 12:52 NVD

HIGH CRITICAL

CVSS changed

Jul 20, 2026 - 12:52 NVD

7.2 (HIGH) 10.0 (CRITICAL)

Patch available

Jul 14, 2026 - 18:20 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 16:33 vuln.today

Analysis Generated

Jul 14, 2026 - 16:33 vuln.today

CVE Published

Jul 14, 2026 - 15:51 cve.org

HIGH 7.2

DescriptionNVD

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.

AnalysisAI

Server-Side Request Forgery and information disclosure in Roundcube Webmail (1.6.x before 1.6.17 and 1.7.x before 1.7.2) arises from insufficient CSS sanitization in HTML email messages, allowing an attacker who sends a crafted message to make the mail server fetch attacker-chosen URLs - including internal/local network hosts - via stylesheet links. This is a re-fix of CVE-2026-35540 and CVE-2026-48843, whose prior patches were incomplete, and the 1.7.2 notes explicitly cite 'SSRF bypass via specific local address URLs - two new cases.' No public exploit is identified at time of analysis and the vulnerability is not on CISA KEV; EPSS is low (0.22%, 13th percentile) despite the source-assigned CVSS of 10.0.

Technical ContextAI

The affected component is Roundcube's HTML email rendering pipeline, specifically its CSS sanitizer that processes stylesheet references embedded in inbound HTML messages. The root cause is CWE-918 (Server-Side Request Forgery): the sanitizer fails to fully block CSS constructs (e.g. stylesheet link/@import URLs) that resolve to internal or local-network addresses, so the server side of Roundcube can be coerced into issuing outbound requests. Because this bug is a regression of earlier fixes (CVE-2026-35540 and CVE-2026-48843), it is fundamentally an address/URL-filtering bypass - the blocklist of local addresses did not cover all encodings/cases. The single affected CPE is cpe:2.3:a:roundcube:webmail, a PHP-based open-source webmail client commonly deployed on shared hosting and enterprise mail gateways.

RemediationAI

Vendor-released patch: upgrade to Roundcube Webmail 1.7.2 (for the 1.7.x branch) or 1.6.17 (for the 1.6.x branch), available at https://github.com/roundcube/roundcubemail/releases/tag/1.7.2 and https://github.com/roundcube/roundcubemail/releases/tag/1.6.17, with the corresponding fixes in commits 6d69e094d55d3a9a84dfb36edf6ca985311f0c1c and 294c7da6e7284166f040cef8607b677d459e0786. Because prior fixes for CVE-2026-35540 and CVE-2026-48843 were insufficient, do not rely on those earlier releases - apply the full 1.6.17/1.7.2 update. If patching must be delayed, compensating controls include disabling remote/external content loading in HTML messages so stylesheets and images are not fetched server-side (trade-off: legitimate remote content in mail will break for users), and egress-filtering the webmail server so it cannot reach internal/RFC1918 or link-local addresses (trade-off: may interfere with internal integrations the server legitimately needs). Back up data before upgrading, per the vendor's guidance.