CVE-2026-48843: Roundcube Webmail SSRF Vulnerability

CVE-2026-48843 Overview

CVE-2026-48843 affects Roundcube Webmail versions 1.6.14 through 1.6.15 and 1.7.x before 1.7.1. The vulnerability stems from insufficient Cascading Style Sheets (CSS) sanitization in HTML email messages. Attackers can craft stylesheet links that point to local network hosts, leading to Server-Side Request Forgery (SSRF) or information disclosure. The flaw represents an incomplete fix for the previously disclosed CVE-2026-35540, allowing attackers to bypass the original patch using specific local address URL formats. The vulnerability is classified under [CWE-918] (Server-Side Request Forgery).

Critical Impact

Remote, unauthenticated attackers can send specially crafted HTML emails to trigger internal network requests from the Roundcube server, exposing internal services and potentially leaking sensitive information.

Affected Products

• Roundcube Webmail 1.6.14
• Roundcube Webmail 1.6.15
• Roundcube Webmail 1.7.0

Discovery Timeline

• 2026-05-24 - Roundcube publishes security updates 1.6.16 and 1.7.1
• 2026-05-25 - CVE-2026-48843 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-48843

Vulnerability Analysis

The vulnerability resides in Roundcube's HTML email rendering pipeline, specifically in how the application sanitizes CSS content embedded in messages. When Roundcube processes an HTML email containing stylesheet references, it fails to adequately validate URL targets that resolve to internal network addresses. Attackers exploit this gap by embedding <link> elements or @import directives pointing to internal hosts, such as http://127.0.0.1 or RFC1918 ranges. The server then issues outbound requests on the attacker's behalf, enabling reconnaissance of internal services and exfiltration of response data.

Root Cause

The root cause lies in the URL validation logic within program/lib/Roundcube/rcube_utils.php. The original fix for CVE-2026-35540 introduced IP address parsing through the IPLib library, but did not account for all encoding variations and address representations that resolve to local network ranges. Specific local address URL formats bypassed the deny-list filter, allowing the request to proceed to internal endpoints.

Attack Vector

Exploitation requires no authentication or user interaction beyond opening the malicious email in the Roundcube interface. An attacker sends an HTML email containing CSS references to internal targets. When the recipient views the message, Roundcube fetches the referenced stylesheet from the server side, returning content or behavioral signals that the attacker can leverage to map internal infrastructure.

<?php

use IPLib\Factory;
+use IPLib\ParseStringFlag;

/*
 +-----------------------------------------------------------------------+

Source: Roundcube Commit ab96c88

The patch imports ParseStringFlag from the IPLib library to enable stricter parsing modes when evaluating whether a URL target resolves to a local or private network address. The added flag controls how ambiguous address formats are interpreted, closing the bypass that allowed local addresses to pass validation.

Detection Methods for CVE-2026-48843

Indicators of Compromise

• Outbound HTTP/HTTPS requests originating from the Roundcube web server to internal IP ranges (RFC1918, loopback, link-local) shortly after email message rendering
• HTML email messages in user mailboxes containing <link rel="stylesheet"> or @import references targeting numeric IP addresses
• Web server access logs showing stylesheet fetch operations to non-standard internal hosts
• Unexpected DNS resolution requests for internal hostnames from the webmail server

Detection Strategies

• Inspect incoming email content for CSS payloads referencing private IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254
• Correlate Roundcube process activity with outbound network connections to internal subnets using endpoint and network telemetry
• Deploy egress filtering rules on the Roundcube host and alert on any connection attempts that violate them

Monitoring Recommendations

• Enable verbose logging in Roundcube and forward web server access logs to a centralized SIEM for analysis
• Monitor PHP outbound HTTP client activity, including curl and stream wrapper calls, for anomalous destinations
• Track Roundcube version inventory across the environment to confirm patched releases are deployed

How to Mitigate CVE-2026-48843

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.6.16 or 1.7.1 immediately, as these releases contain the corrected URL validation logic
• Restrict outbound network access from the Roundcube web server to only required destinations through host-based or perimeter firewalls
• Audit recent email logs and server access logs for evidence of exploitation attempts targeting internal addresses

Patch Information

Roundcube released fixes in versions 1.6.16 and 1.7.1 on 2026-05-24. The patches are tracked in commits ab96c88b and cb3fc904, both modifying program/lib/Roundcube/rcube_utils.php to enforce stricter IP address parsing. See the Roundcube Security Updates Announcement and the Roundcube Release 1.6.16 and Roundcube Release 1.7.1 notes.

Workarounds

• Disable HTML email rendering in Roundcube preferences to force plain-text display until patches are applied
• Configure network egress controls to block Roundcube server connections to internal RFC1918 ranges, loopback, and cloud metadata services
• Deploy a web application firewall rule to inspect inbound email content for suspicious CSS link patterns referencing internal addresses

# Upgrade Roundcube on a typical Linux deployment
cd /var/www/roundcubemail
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.16/roundcubemail-1.6.16-complete.tar.gz
tar -xzf roundcubemail-1.6.16-complete.tar.gz
./bin/installto.sh /var/www/roundcubemail

# Restrict egress to internal ranges via iptables
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.0.0/16 -j REJECT