Roundcube Webmail prior to 1.6.20 and 1.7.5 contains a server‑side request forgery vulnerability that arises from a bypass of the is_local_url() filter. URLs containing the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, as well as the unspecified address ::/128, are incorrectly considered local, allowing the application to fetch internal resources such as loopback, link‑local, and cloud metadata endpoints. An attacker can thereby cause Roundcube to issue requests to addresses that were intended to be unreachable, potentially exposing internal services or gathering network information.

The flaw affects Roundcube Webmail versions 1.6.14 through 1.6.19 and 1.7.0 through 1.7.4. All users of these releases are susceptible until the vendor releases 1.6.20 or later and 1.7.5 or later, which patch the is_local_url() function to block the aforementioned prefixes.

The CVSS score of 7.2 reflects a high potential impact. With no EPSS data available, the probability of exploitation cannot be precisely quantified, but the fact that the vulnerability is not listed in the CISA KEV catalog does not reduce its seriousness for systems exposed to user input. Remote attackers who can supply or influence URLs used by Roundcube have a straightforward network‑based attack path that can reach internal loopback or cloud metadata endpoints, enabling information disclosure or further lateral movement.