Roundcube Webmail up to 1.6.15/1.7.0 incomplete blacklist

Summaryinfo

A vulnerability classified as critical has been found in Roundcube Webmail up to 1.6.15/1.7.0. The affected element is an unknown function. This manipulation causes incomplete blacklist. This vulnerability is tracked as CVE-2026-9818. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Roundcube Webmail up to 1.6.15/1.7.0. It has been declared as critical. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a incomplete blacklist vulnerability. The CWE definition for the vulnerability is CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services simply by opening the message preview.

The weakness was disclosed with Orange Cyberdefense. The advisory is shared at github.com. This vulnerability is known as CVE-2026-9818 since 05/28/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1562.006 for this issue.

Upgrading to version 1.6.16 or 1.7.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32893). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Mail Client Software

Vendor

• Roundcube

Name

• Webmail

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.7.0

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion