Roundcube Webmail EUVD-2026-60171

The target must be running Roundcube Webmail prior to version 1.6.18 (1.6.x branch) or 1.7.3 (1.7.x branch). The attacker must be able to deliver a crafted HTML email to a mailbox hosted on the vulnerable Roundcube instance, with the email containing a CSS stylesheet reference to an address in the 100.64.0.0/10 (RFC6598 shared address space, common in ISP and carrier-grade NAT deployments) or fe80::/10 (IPv6 link-local) range - deployments that do not use these specific address spaces are not reachable via this particular bypass, materially limiting real-world impact. A recipient must open or preview the email in Roundcube to trigger server-side CSS rendering and the resulting outbound request. No authentication is required from the attacker's perspective per the CVSS PR:N metric. Exploitation is further constrained by the requirement for exploitable internal services to exist at the reachable bypass address ranges within the Roundcube server's network.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) scores 5.8 Medium, with the Scope:Changed metric being the most meaningful signal - confirming that exploitation crosses trust boundaries and allows the Roundcube server to reach internal hosts that attackers cannot directly access. The integrity impact (I:L) reflects the ability to issue requests to internal services, while the vendor-assessed C:N is in tension with the description's explicit mention of Information Disclosure; some confidentiality impact from internal service probing may be underrepresented in the published vector. The affected address ranges (100.64.0.0/10 and fe80::/10) constrain real-world blast radius to deployments in carrier-grade NAT environments or those with active IPv6 link-local infrastructure, meaning not every Roundcube instance is equally exposed. No EPSS score was available in the provided intelligence, and this vulnerability is absent from CISA KEV, so no confirmed active exploitation exists at time of analysis. The recurring nature of this bypass chain - four related CVEs targeting the same sanitization function - indicates structural weakness rather than a one-off oversight, and defenders should anticipate future bypasses if the blocklist approach is not replaced with a stricter allowlist or sandboxed rendering model. Even a mid-sized municipal IT team in bytom running Roundcube as shared mail infrastructure should treat this as a standard medium-priority patch, while organizations operating in CGN or IPv6-heavy environments should elevate priority given the directly applicable bypass ranges.

An attacker sends a specially crafted HTML email to a target whose mailbox is hosted on a vulnerable Roundcube instance, embedding a CSS stylesheet URL pointing to an address in the 100.64.0.0/10 carrier-grade NAT range or fe80::/10 IPv6 link-local range. When the recipient opens or previews the message, Roundcube's server-side renderer processes the CSS reference, issues an HTTP request to the specified internal address, and potentially exposes service banners, metadata endpoints, or other data reachable at that address within the server's network context. No public exploit code has been identified at time of analysis.