CVE-2026-114730: SSRF
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcubeutils::islocalurl() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (islocalurl()) bypass via NAT64 64:ff9b::/96”.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which deployments are affected?
Roundcube Webmail versions 1.6.14 through before 1.6.20 and 1.7.0 through before 1.7.5 are affected. The issue is in the URL filtering performed by rcube_utils::is_local_url().
What does an attacker need to exploit this issue?
The attack can be performed over the network with low complexity and requires no privileges or user interaction. An attacker needs a way to cause Roundcube to process a crafted URL using the omitted NAT64 or unspecified IPv6 address forms.
What internal targets could be reached?
Crafted URLs that bypass the filter can reach loopback, link-local, and cloud metadata addresses. For example, http://[64:ff9b::7f00:1]/ can represent a loopback destination through the RFC 6052 NAT64 prefix.
How can this be remediated?
Update affected 1.6.x installations to 1.6.20 or later, and affected 1.7.x installations to 1.7.5 or later. The upstream fix updates the SSRF filtering for the omitted NAT64 prefixes and unspecified address.