CVE-2026-62643: Roundcube Webmail: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sh…
Critical 10.0 EPSS 0.3% Roundcube Webmail
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.
- CVE-2026-62643CVE identifier
- 10.0CVSS 3.1 base score (critical)
- 0.3%EPSS: chance of exploitation in the next 30 days (higher than 22% of CVEs)
- 2026-07-14published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Roundcube Webmail and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reload PHP-FPM / the web server after updating; check plugins and run bin/update.sh for tarball installs
Affected and fixed versions
Affected:
- Roundcube Webmail 1.6.0 to before 1.6.17
- Roundcube Webmail 1.7.0 to before 1.7.2
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade roundcube-coreUbuntu
sudo apt update
sudo apt install --only-upgrade roundcube-coreRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh roundcubemail (EPEL)Fedora
sudo dnf upgrade --refresh roundcubemailSUSE / openSUSE
sudo zypper refresh
sudo zypper update roundcubemailAmazon Linux
not in distro repos: vendor repositoryArch Linux
sudo pacman -SyuAlpine
not packaged: upstream tarballFreeBSD
pkg update && pkg upgrade roundcube-php84 (roundcube-phpXY)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | roundcube | fixed | 1.6.5+dfsg-1+deb12u10 |
| Debian 13 | roundcube | fixed | 1.6.17+dfsg-0+deb13u1 |
| Debian testing | roundcube | fixed | 1.6.17+dfsg-1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
- https://github.com/roundcube/roundcubemail/commit/6d69e094d55d3a9a84dfb36edf6ca985311f0c1c
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
- https://github.com/roundcube/roundcubemail/commit/294c7da6e7284166f040cef8607b677d459e0786
- CVE-2026-62643 on CVE.org
- CVE-2026-62643 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.