You open an email. While you are reading it, your mail server is already knocking on an internal address you never handed it, because the email told it to. Not a thought experiment. I reproduced it on a lab and caught the request in a log.
Reading an email stopped being a passive act a long time ago. The client parses MIME, renders text into HTML, pulls in styles, shows attachments, turns addresses and links into clickable ones. Every one of those steps is code that runs over data a stranger sent you. And the moment one of those steps trusts that data a little more than it should, the email starts doing things you did not ask for.
In July 2026 Roundcube shipped release 1.6.17, and it is not one patch, it is a whole list. Two of the fixed bugs sit at the top of the scale: NIST rates both 10.0 out of 10, while MITRE is more cautious on the SSRF and gives it 7.2. One of them lets an email make your mail server reach into the internal network on its own. I stood up the vulnerable version on an isolated lab and walked the attack end to end, down to the log line that catches the request coming from the server itself. I will also be honest about where the public data ends and why the second 10.0 cannot be reproduced from it.
