Insufficient CSS Sanitization in Roundcube Webmail Products

CVE-2026-48843

What is CVE-2026-48843?

Certain versions of Roundcube Webmail exhibit a vulnerability linked to inadequate sanitization of Cascading Style Sheets (CSS) used in HTML email messages. This can potentially lead to issues such as Server-Side Request Forgery (SSRF) or unintentional information disclosure, particularly if the stylesheet links direct to resources on the local network. The root cause relates to an insufficient resolution of a previous issue documented in CVE-2026-35540.

References