CVE-2026-62643
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In Roundcube Webmail before versions 1.6.17 and 1.7.2, insufficient CSS sanitization in HTML email messages may lead to SSRF or information disclosure when stylesheet links point to local network hosts.
Risk Assessment
The organization is at risk of sensitive information leakage about internal network infrastructure and potential SSRF attacks that could enable further exploitation of internal systems.
Recommendation
Immediately update Roundcube Webmail to version 1.6.17 or later (for the 1.6.x branch) or to version 1.7.2 or later (for the 1.7.x branch).
Other vulnerabilities in Roundcube Webmail
See all- CVE-2026-75010Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has a vulnerability in the modoboa driver of the password plugin that could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver.
- CVE-2026-75006Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure, e.g., if stylesheet links point to local network hosts. This is due to incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643.
- CVE-2026-75004Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has improper rule name quoting that could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This affects only instances using the managesieve plugin.
- CVE-2026-74999Medium
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.
- CVE-2026-74998High
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.
- CVE-2026-74997High
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
- CVE-2015-5383High
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
- CVE-2017-8114High
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- CVE-2016-4069High
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
- CVE-2026-75007Medium
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to LDAP search filter injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
Original NVD description (English source)
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.