Executive brief
Roundcube Webmail, a popular open-source email client, contains a security flaw in how it handles HTML emails. An attacker can send a specially crafted email that forces the webmail server to make unauthorized requests to internal network resources. This could allow an attacker to view sensitive information from within the organization's private network that is normally protected from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Roundcube Webmail versions 1.6.0 through 1.6.13. The issue stems from insufficient sanitization of Cascading Style Sheets (CSS) within HTML email messages. Specifically, the application fails to properly validate or restrict stylesheet links, allowing an attacker to include links pointing to internal local network hosts. When the webmail server processes these emails, it may attempt to fetch these resources, leading to information disclosure or internal network scanning. The vulnerability is addressed in versions 1.6.14 and 1.7-rc5 by improving the CSS sanitization logic.
Affected products
- Roundcube Webmail 1.6.0 to 1.6.13
Timeline
- 2026-03-18: patched: Security updates 1.6.14 and 1.7-rc5 released.
- 2026-04-03: disclosed: CVE-2026-35540 published.
References
- https://github.com/roundcube/roundcubemail/commit/27ec6cc9cb25e1ef8b4d4ef39ce76d619caa6870
- https://github.com/roundcube/roundcubemail/commit/579b68eff90650a5c782e153debd66c765648942
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
- https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14