CyberRota Analysis
AI-GeneratedRoundcube Webmail versions prior to 1.6.18 and 1.7.x before 1.7.3 are vulnerable due to inadequate sanitization of Cascading Style Sheets (CSS) in HTML emails, potentially allowing for Server-Side Request Forgery (SSRF) or information disclosure if stylesheet links target local network hosts. Organizations using these versions should prioritize patching to mitigate the risk of unauthorized access to internal resources. This vulnerability is particularly relevant for administrators managing webmail services in environments where sensitive data is handled.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
Related CVEs
Other vulnerabilities affecting the same vendor(s)