CVE-2026-114730 | Roundcube Webmail up to 1.6.19/1.7.4 SSRF Filter is_local_url server-side request forgery

October 22, 2026 Yanac

A vulnerability marked as critical has been reported in Roundcube Webmail up to 1.6.19/1.7.4. This affects the function rcube_utils::is_local_url of the component SSRF Filter. Performing a manipulation results in server-side request forgery.

This vulnerability was named CVE-2026-114730. The attack may be initiated remotely. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More