Fix SSRF bypass via specific local address URLs - two new cases

Author: alecpl

CHANGELOG.md

@@ -17,6 +17,7 @@ This file includes only changes we consider noteworthy for users, admins and plu
 - Fix support for untyped tokens in OIDC backchannel logout, require unset `nonce` (#10097)
 - Security: Fix various vulnerabilities in the password plugin using session-injected username
 - Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
+- Security: Fix SSRF bypass via specific local address URLs - two new cases
 
 ## Release 1.7.1
 

program/lib/Roundcube/rcube_utils.php

@@ -437,9 +437,9 @@ public static function is_local_url($url)
             $host = trim($host, '[]');
 
             // IPLib does not seem to work with IPv6 syntax for IPv4 addresses
-            $host = preg_replace('/^::ffff:/i', '', $host);
+            $host = preg_replace('/^[0:]*:ffff:/i', '', $host);
 
-            if (preg_match('/([0-9a-f.-]+)\.nip\.io$/i', $host, $matches)) {
+            if (preg_match('/([0-9a-f.-]+)\.(nip|sslip)\.io$/i', $host, $matches)) {
                 $host = trim($matches[1], '-.');
             }
 

tests/Framework/UtilsTest.php

@@ -726,6 +726,9 @@ public static function provide_is_local_url_cases(): iterable
             ['http://[::ffff:127.0.0.1]:8080', true],
             ['http://127.0.0.1.nip.io', true],
             ['http://metadata.google.internal', true],
+            ['http://127.0.0.1.sslip.io/', true],
+            ['http://[0:0:0:0:0:ffff:127.0.0.1]/', true],
+            ['http://0/', true],
             // Non-local hosts
             ['http://[2001:470::76:0:0:0:2]', false],
             ['http://domain.tld', false],