CVE-2026-35540: An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization

Description

An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.

Affected Products

References

• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
• https://github.com/roundcube/roundcubemail/commit/579b68eff90650a5c782e153debd66c765648942
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
• https://github.com/roundcube/roundcubemail/commit/27ec6cc9cb25e1ef8b4d4ef39ce76d619caa6870

Related News (1 articles)