CVE-2026-35540 MEDIUM

CVE-2026-35540

Vendor Roundcube
Product Webmail
Weakness CWE-669
Published April 3, 2026
Last update April 3, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.

Key dates

02Disclosure timeline

April 3, 2026 CVE published
April 3, 2026 Record updated