CVE-2026-62643 is a high severity (CVSS 7.2) server side request forgery in Roundcube Webmail. Weak CSS sanitization in HTML email can lead to SSRF or information disclosure. Fixed in 1.6.17 and 1.7.2. It exists because earlier fixes for CVE-2026-35540 and CVE-2026-48843 were insufficient.
What's affected
- Roundcube Webmail before 1.6.17 on the 1.6 line. Fixed in 1.6.17.
- Roundcube Webmail 1.7.x before 1.7.2. Fixed in 1.7.2.
- Weakness: CWE-918, server side request forgery. CVSS 7.2 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. - The record says the flaw exists because the fixes for CVE-2026-35540 and CVE-2026-48843 were insufficient. An example it gives is stylesheet links that point at local network hosts.
How to check if you're exposed
Read the version from the Roundcube About dialog, or from the source tree.
grep -r "RCMAIL_VERSION" program/include/iniset.php
Anything before 1.6.17 on the 1.6 line, or before 1.7.2 on the 1.7 line, is in range. Check Docker images and distribution packages too, since those carry their own version numbers.
Then look at what your webmail server can reach. SSRF matters most when the server can talk to internal addresses, so list the internal services reachable from it.
What to do now
- Find every Roundcube install and note the version.
- Update to 1.6.17 or 1.7.2 at least. The Roundcube news page lists later security releases (1.6.18, 1.7.3, 1.6.19, 1.7.4), so prefer the newest one.
- Restrict outbound traffic from the webmail server so it cannot reach internal management interfaces or cloud metadata addresses.
- Keep remote content blocking on for HTML mail.
Why it matters
Email is untrusted content that a server renders for a user. Style sheets can reference outside resources, and if the server fetches or allows those fetches, a message can steer requests toward addresses the sender should never reach. That is CWE-918.
The record says this is a follow up. Earlier fixes covered some cases, and this one covers more. SSRF fixes often arrive as a series, because blocking every local address form is hard. Egress limits on the server are the durable backstop. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is this a repeat issue?
The record says it exists because earlier fixes for CVE-2026-35540 and CVE-2026-48843 were insufficient.
What limits the damage even before patching?
Blocking the webmail server's access to internal addresses.
Sources
Last reviewed: 19 October 2026.
