CVE-2026-62643: SSRF
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
roundcubeto a version that resolves this vulnerability.Fixed in 1.6.17 - Upgrade
Upgrade
roundcubeto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62643?
The severity of CVE-2026-62643 is high with a score of 7.2.
How do I fix CVE-2026-62643?
To fix CVE-2026-62643, upgrade to Roundcube Webmail version 1.6.17 or 1.7.2 or later.
What type of vulnerability is CVE-2026-62643?
CVE-2026-62643 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What can an attacker achieve with CVE-2026-62643?
An attacker exploiting CVE-2026-62643 may gain access to sensitive information or local network hosts through CSS sanitization issues.
In which versions of Roundcube is CVE-2026-62643 present?
CVE-2026-62643 affects Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2.