UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback,…

Severity
High 7.2
Published
22 Oct 2026
Last changed
28 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
CVE Program

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • From 1.6.14 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114730