CVE Catalog
CVE-2026-35540
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.31%
23th percentile - higher than 23% of all known CVEs
Summary
In Roundcube Webmail from version 1.6.0 to 1.6.14, insufficient CSS sanitization in HTML emails may lead to SSRF or information disclosure, e.g., when stylesheet links point to local network hosts.
Risk Assessment
The organization risks SSRF attacks that could enable scanning of the internal network or access to sensitive resources, as well as information leakage.
Recommendation
Update Roundcube Webmail to version 1.6.14 or later, which contains the fix.
Original NVD description (English source)
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.