CVE-2026-75006: SSRF
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.18 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75006?
CVE-2026-75006 has a medium severity rating of 5.8.
How do I fix CVE-2026-75006?
To fix CVE-2026-75006, you should update Roundcube Webmail to version 1.6.18 or 1.7.3.
What type of vulnerability is CVE-2026-75006?
CVE-2026-75006 is categorized as an SSRF (Server-Side Request Forgery) vulnerability.
What are the potential impacts of CVE-2026-75006?
CVE-2026-75006 may lead to SSRF or information disclosure if exploited.
In which versions of Roundcube is CVE-2026-75006 present?
CVE-2026-75006 is present in Roundcube Webmail before version 1.6.18 and in 1.7.x before 1.7.3.