PT-2026-7485 · Roundcube+3 · Roundcube Webmail+3

Nullcathedral · Published 2026-02-11 · Updated 2026-05-08 · CVE-2026-26079

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.13 Roundcube Webmail versions prior to 1.6.13

Description The webmail application allows for Cascading Style Sheets (CSS) injection due to improper handling of comments. This can potentially lead to modifications of the webmail interface.

Recommendations Update Roundcube Webmail to version 1.5.13 or later. Update Roundcube Webmail to version 1.6.13 or later.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

BDU:2026-07200

CVE-2026-26079

MGASA-2026-0065

OPENSUSE-SU-2026:20323-1

USN-8223-1

Affected Products

Linuxmint

Red Os

Roundcube Webmail

Ubuntu

References · 45

• https://bdu.fstec.ru/vul/2026-07200 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26079 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8223-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-26079 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25916 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20323-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26079 · Security Note
• https://ubuntu.com/security/CVE-2024-38357 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0065.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15237 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0065 · Vendor Advisory