Vulnerability record · CVE-2026-62643 · published 14 July 2026

CVE-2026-62643: Roundcube webmail server-side request forgery (ssrf) vulnerability

Roundcube · Webmail

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.

10.0 CVSS 3.1 Critical EPSS 0.44% · top 64.3% CWE-918 · Server-side request forgery (SSRF)

10.0CVSS 3.1 base score

0.44%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References

20 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Webmail Roundcube

References

Link	Tags
https://github.com/roundcube/roundcubemail/commit/294c7da6e7284166f040cef8607b677d459e0786	Patch
https://github.com/roundcube/roundcubemail/commit/6d69e094d55d3a9a84dfb36edf6ca985311f0c1c	Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.17	Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2	Release Notes
https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2	Vendor Advisory

Track CVE-2026-62643 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-44026Roundcube Webmail SQL injection via search parametersRoundcube Webmail before 1.3.17 and 1.4.x before 1.4.12 is prone to SQL injection through the search or search_params input. The flaw is remotely rea…KEVEPSS 70%analysed19 Nov 2021 9.8CVE-2020-12641Roundcube Webmail OS command injection via image conversion path settingsRoundcube Webmail before 1.4.4 passes the im_convert_path and im_identify_path configuration settings to a shell without sanitization in rcube_image.…KEVEPSS 84%analysed4 May 2020 9.3CVE-2024-42009Roundcube Webmail desanitization XSS in message_body()Roundcube Webmail through 1.5.7 and 1.6.x through 1.6.7 contains a cross-site scripting flaw caused by a desanitization issue in message_body() in pr…KEVEPSS 83%analysed5 Aug 2024 8.8CVE-2025-49113Roundcube Webmail PHP Object Deserialization RCE via _from ParameterRoundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 fails to validate the _from parameter in program/actions/settings/upload.php, allowing PHP ob…KEVEPSS 99%analysed2 Jun 2025 7.8CVE-2017-16651Roundcube Webmail file disclosure via attachment pluginRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows an authenticated user to read arbitrary files on the host filesyst…KEVEPSS 46%analysed9 Nov 2017 6.1CVE-2025-68461Roundcube Webmail XSS via SVG animate tagRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is vulnerable to cross-site scripting through the animate tag in an SVG document. Because the f…KEVEPSS 27%analysed18 Dec 2025 6.1CVE-2024-37383Roundcube Webmail XSS via SVG animate attributesRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 is vulnerable to cross-site scripting through SVG animate attributes. Because the flaw sits in …KEVEPSS 73%analysed7 Jun 2024 6.1CVE-2023-43770Roundcube Webmail XSS via crafted links in plain-text emailsRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 is vulnerable to cross-site scripting because of how rcube_string_replacer.php ha…KEVEPSS 64%analysed22 Sep 2023

Source: NIST National Vulnerability Database (record CVE-2026-62643), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.