GitHub Advisoryadvisory · Packagist

GHSA-vxg2-hhgr-37fx Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

MEDIUM Published 2026-04-03 Modified 2026-04-04 Official page ↗
Aliases
CVE-2026-35540
Ecosystem
Packagist
Packages
roundcube/roundcubemail
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-669, CWE-918
Reviewed
2026-04-04

Affected packages

• Packagist roundcube/roundcubemail: >= 1.7-beta, < 1.7-rc5 → fixed in 1.7-rc5

Description

An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.

Related

Alias · CVE (1)

  • CVE-2026-35540 An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. vulnerability

Weakness · CWE (2)

  • CWE-669 Incorrect Resource Transfer Between Spheres weakness
  • CWE-918 Server-Side Request Forgery weakness

References