Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Roundcube Server-Side Request Forgery (SSRF) Vulnerability - CVE-2026-62643 - Vulnerability Database
Roundcube

Roundcube Server-Side Request Forgery (SSRF) Vulnerability - CVE-2026-62643

Critical
Reference: CVE-2026-62643
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-62643
Title: Roundcube Server-Side Request Forgery (SSRF) Vulnerability
Overview:

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure e.g. if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.