CVE-2026-114730
Fixed in a distro release EPSS <1%CVSS 7.2
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Products: roundcube webmail
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | roundcube | no fix |
| Debian 13 | roundcube | 1.6.20+dfsg-0+deb13u1 |
| Debian 14 | roundcube | 1.6.20+dfsg-1 |
| Ubuntu 26.10 | roundcube | no fix |
| Ubuntu Pro 16.04 LTS | roundcube | no fix |
| Ubuntu Pro 18.04 LTS | roundcube | no fix |
| Ubuntu Pro 20.04 LTS | roundcube | no fix |
| Ubuntu Pro 22.04 LTS | roundcube | no fix |
| Ubuntu Pro 24.04 LTS | roundcube | no fix |
| Ubuntu Pro 26.04 LTS | roundcube | no fix |