PT-2026-29979 · Roundcube+1 · Roundcube Webmail+1

Y0Us · Published 2026-03-18 · Updated 2026-05-25 · CVE-2026-35540

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.6.0 through 1.6.13

Description An issue exists in Roundcube Webmail where insufficient Cascading Style Sheets (CSS) sanitization in HTML email messages could lead to Server-Side Request Forgery (SSRF) or Information Disclosure. This can occur if stylesheet links point to local network hosts.

Recommendations Update Roundcube Webmail to version 1.6.14 or later.

Fix

SSRF

Weakness Enumeration

CWE-669

CWE-918

Related Identifiers

BDU:2026-06180

CVE-2026-35540

GHSA-VXG2-HHGR-37FX

Affected Products

Red Os

Roundcube Webmail

References · 20

• https://github.com/roundcube/roundcubemail/commit/579b68eff90650a5c782e153debd66c765648942 · Patch
• https://github.com/roundcube/roundcubemail/commit/27ec6cc9cb25e1ef8b4d4ef39ce76d619caa6870 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35540 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35540 · Security Note
• https://ubuntu.com/security/CVE-2026-35540 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06180 · Security Note
• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35540 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxg2-hhgr-37fx · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35540 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35540 · Vendor Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 · Note
• https://github.com/roundcube/roundcubemail · Note
• https://i0.rs/blog/turning-a-roundcube-link-tag-into-a-zero-day-ssrf-and-data-exfiltration · Note