{"id":"CVE-2026-114730","aliases":[],"title":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.","titleSource":"mitre","descriptionSource":"mitre","products":[{"vendor":"Roundcube","name":"Webmail","platforms":[],"versions":[{"version":"1.6.14","status":"affected","lessThan":"1.6.20","versionType":"semver"},{"version":"1.7.0","status":"affected","lessThan":"1.7.5","versionType":"semver"}],"defaultStatus":"unaffected","source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-114730"}],"remediation":[],"description":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.","severity":"high","score":7.2,"published":"2026-10-22T02:09:40.059Z","modified":"2026-10-28T02:18:48.643Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://bugs.debian.org/1151279","https://github.com/roundcube/roundcubemail/commit/6e1d480e730a45f29829b6a11af608d5d6eb3db6","https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090"],"sources":[{"name":"CVE","id":"CVE-2026-114730","modified":"2026-10-28T02:18:48.643Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114730"}],"assessments":[{"source":"mitre","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","score":7.2}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:45:31.448Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}