CVE-2026-75006 in Roundcube
Summary
by MITRE • 08/17/2026
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.18 and the 1.7.x series before version 1.7.3 stems from a critical deficiency in the sanitization of Cascading Style Sheets within HTML-formatted email messages. This flaw represents an incomplete remediation of previously disclosed security issues, specifically CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643, indicating that earlier patches failed to fully address the underlying parsing logic errors. When a user opens an HTML email containing maliciously crafted CSS rules, particularly those utilizing external style sheet links or data URIs, the application fails to adequately validate the target resources against a strict allowlist of permitted domains and protocols. This lack of rigorous validation allows attackers to inject references pointing toward internal network hosts that are not accessible from the public internet but are reachable by the Roundcube server itself.
The operational impact of this vulnerability is severe due to its potential for Server-Side Request Forgery, commonly known as SSRF. By manipulating CSS properties such as background-image or @import rules, an attacker can force the Roundcube application server to initiate HTTP requests to internal services running on localhost or other private IP addresses within the organization's network infrastructure. This capability effectively bypasses perimeter firewalls and access control lists that typically protect these internal assets from external exposure. Through SSRF, attackers may interact with administrative interfaces of internal applications, query metadata endpoints on cloud instances, or probe for vulnerable services such as Redis, Elasticsearch, or database management tools running internally. The ability to make arbitrary requests from the server context grants an attacker a significant foothold within the network topology, potentially leading to further lateral movement and deeper compromise of the environment.
In addition to SSRF risks, this vulnerability facilitates information disclosure through techniques that exploit how browsers render stylesheets containing external resources. Attackers can craft payloads designed to exfiltrate data from internal services by encoding sensitive responses into CSS properties or using beacon-like mechanisms triggered during style application. This aligns with CWE-918, which addresses Server-Side Request Forgery flaws where the server makes requests on behalf of a user without proper validation. Furthermore, the failure to sanitize external resources relates closely to CWE-749, as it involves exposing internal system functionality to unauthorized actors through improper access control mechanisms in web application design. The persistence of this issue despite prior patches highlights the complexity of sanitizing complex CSS parsers and underscores the difficulty of maintaining strict security boundaries when processing untrusted input from email sources.
To mitigate these risks, organizations running affected versions of Roundcube must immediately upgrade to version 1.6.18 or later for the stable branch, or version 1.7.3 and above for the development branch. These releases contain comprehensive fixes that enforce stricter validation rules on CSS properties, specifically blocking external resource loading unless explicitly whitelisted by administrators. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict outbound HTTP traffic from the Roundcube server IP address to only known legitimate domains and internal services required for core functionality. Implementing a web application firewall with rules that detect SSRF patterns in CSS payloads can also provide an additional layer of defense. Security teams should monitor logs for unusual outbound connection attempts originating from the mail server, as these may indicate active exploitation attempts targeting internal infrastructure through this vector.