CVE details
CVE-2026-114730
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
- Score
- 7.2 high
- Published
- 2026-10-22
- Links
- NVD · cve.org · Report wrong data
Matched ports (5)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| mail/roundcube | roundcube-php82 | 1.7.5,1 | fixed by update | ale@FreeBSD.org |
| mail/roundcube | roundcube-php83 | 1.7.5,1 | fixed by update | ale@FreeBSD.org |
| mail/roundcube | roundcube-php84 | 1.7.5,1 | fixed by update | ale@FreeBSD.org |
| mail/roundcube | roundcube-php85 | 1.7.5,1 | fixed by update | ale@FreeBSD.org |
| mail/roundcube | roundcube-php86 | 1.7.5,1 | fixed by update | ale@FreeBSD.org |