Insufficient CSS Sanitization in Roundcube Webmail by Roundcube

CVE-2026-75006

What is CVE-2026-75006?

The vulnerability in Roundcube Webmail arises from inadequate sanitization of Cascading Style Sheets (CSS) within HTML e-mail messages. This flaw can potentially enable attackers to exploit stylesheet links that direct requests to internal network hosts, leading to Server-Side Request Forgery (SSRF) or the unauthorized disclosure of sensitive information. The issue has not been resolved adequately despite previous attempts to address similar vulnerabilities.

References