Listen to this Post
How CVE-2026-62643 Works
Roundcube Webmail is a popular open-source, browser-based IMAP email client written in PHP. Prior to versions 1.6.17 and 1.7.2, the application suffers from a critical flaw in its handling of Cascading Style Sheets (CSS) within HTML-formatted email messages. The root cause is insufficient sanitization of CSS rules extracted from incoming emails, which allows an attacker to embed external resource references that the Roundcube rendering engine will faithfully process.
When a victim opens a specially crafted email, the Roundcube client parses the embedded CSS and encounters `@import` or `url()` directives that point to internal network hosts, localhost, or other restricted resources. Because the sanitization logic fails to properly validate these URLs—by not blocking obfuscated forms such as IPv6-mapped IPv4 addresses (::ffff:127.0.0.1), DNS rebinding domains (nip.io), or alternative integer/octal representations (0x7f000001, 0177.0.0.1, 2130706433)—the server-side rendering engine will initiate HTTP requests to those destinations. This behavior effectively turns the Roundcube server into an SSRF proxy.
The attack chain is deceptively simple: an adversary sends an HTML email containing a malicious `