CVE-2026-114730
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48, and the unspecified address ::/128, allowing URLs such as http://[64:ff9b::7f00:1]/ to reach loopback, link-local, and cloud metadata addresses.
Risk Assessment
An attacker could exploit the filter bypass to send requests to internal resources, including cloud metadata services, potentially resulting in data leakage or privilege escalation.
Recommendation
Upgrade Roundcube Webmail to a version containing the fix (commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”).
Other vulnerabilities in Roundcube Webmail
See all- CVE-2015-5383High
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
- CVE-2017-8114High
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- CVE-2016-4069High
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
- CVE-2024-37383MediumActively exploited
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. This could lead to execution of malicious JavaScript in the victim's browser.
- CVE-2020-35730MediumActively exploited
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
- CVE-2020-13965MediumActively exploited
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
- CVE-2020-12641CriticalActively exploited
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
- CVE-2026-114732Medium
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host.
- CVE-2026-114731Medium
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (utils/modcss action). The fetched stylesheet was read into memory in full with no size limit and no read timeout, allowing server memory exhaustion via an attacker-controlled stylesheet URL.
- CVE-2026-114729Medium
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; thus markup in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Original NVD description (English source)
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS