Insufficient CSS Sanitization in Roundcube Webmail Product

CVE-2026-35540

What is CVE-2026-35540?

An insufficient sanitization flaw in Cascading Style Sheets (CSS) within HTML e-mail messages of Roundcube Webmail versions prior to 1.6.14 can result in Server-Side Request Forgery (SSRF) and potential information disclosure. This vulnerability arises when external stylesheet links, particularly those referencing local network hosts, are processed without adequate checks. Attackers might exploit this to access sensitive information on internal resources, emphasizing the need for prompt updates to secure environments from such risks.

References