CVE-2026-35539

MediumCVSS 6.1

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

An XSS vulnerability was found in Roundcube Webmail before versions 1.5.14 and 1.6.14 due to insufficient sanitization of HTML attachments in preview mode. The victim must preview a text/html attachment.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft or data leakage.

Recommendation

Update Roundcube Webmail to version 1.5.14 or 1.6.14.

Original NVD description (English source)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.