CVE-2026-75006

Katalog CVE

CVSS 5.8 · Medium EPSS 0,42%

Kerentanan Server-Side Request Forgery (SSRF) pada roundcube webmail. Skor CVSS 3.1 5.8 (Medium) menurut mitre.org.

Deskripsi (NVD)

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

5.8 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/7e10ca0110b7c9aa1b7850b843bb6625e47bbe00 patch
• https://github.com/roundcube/roundcubemail/commit/8a92380b06b5df1481e034c4f40d6a6546c21223 patch
• https://github.com/roundcube/roundcubemail/commit/92f85c883594e5be757154f94548a9ba903455c9 patch
• https://github.com/roundcube/roundcubemail/commit/c111b72950cd2bf57d6b86cd129568d90403322d patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 release notes