PT-2026-44369 · Roundcube · Roundcube

Guillaume Meunier · CVE-2026-9818 · Published 2026-05-28 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube (affected versions not specified)

Description The HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs, even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services when the message preview is opened.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-9818

Affected Products

Roundcube

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9818.json · Exploit
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 · Patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 · Patch
• https://github.com/roundcube/roundcubemail/commit/7b52353653a67e6073b97d70eb94047132b78556 · Patch
• https://github.com/roundcube/roundcubemail/commit/faf867432f51ebbe100382a70a9e3c042415ee1b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9818 · Security Note
• https://osv.dev/vulnerability/CVE-2026-9818 · Vendor Advisory
• https://github.com/roundcube/roundcubemail · Note
• https://t.me/cveNotify/165003 · Telegram Post
• https://advisories.orangecyberdefense.com/advisories/163 · Note