Is CVE-2026-35544 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35544 being exploited in the wild.

How severe is CVE-2026-35544?

Medium severity, with a CVSS score of 5.3, published 3 April 2026.

Which products and versions are affected?

roundcube/roundcubemail (Packagist) ECOSYSTEM:introduced=1.7-beta,fixed=1.7-rc5; Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14.

Is there a fix for CVE-2026-35544?

Yes. roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35544 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35544?

Check whether you run roundcube/roundcubemail (Packagist) or Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35544: Roundcube Webmail CSS sanitization bypass in HTML email

Q: Is there a fix for CVE-2026-35544?

Yes. roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35544 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-35544?

Check whether you run roundcube/roundcubemail (Packagist) or Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35544 · Severity: medium · CVSS 5.3 · Published 2026-04-03

Roundcube Webmail, a widely used open-source email client, contains a security flaw in how it handles the styling of incoming HTML emails. An attacker can send a specially crafted email that uses specific CSS commands to bypass security filters intended to keep email content contained. This could allow an attacker to manipulate the visual layout of the webmail interface, potentially leading to UI redressing or other integrity-related issues for the user viewing the message.

Technologies: roundcube/roundcubemail (Packagist), Roundcube Webmail. Vendors: Packagist, Roundcube.

Quick answers

Is CVE-2026-35544 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35544 being exploited in the wild.
How severe is CVE-2026-35544?: Medium severity, with a CVSS score of 5.3, published 3 April 2026.
Which products and versions are affected?: roundcube/roundcubemail (Packagist) ECOSYSTEM:introduced=1.7-beta,fixed=1.7-rc5; Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14.
Is there a fix for CVE-2026-35544?: Yes. roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35544 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35544?: Check whether you run roundcube/roundcubemail (Packagist) or Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later
```
composer require roundcube/roundcubemail:^1.7-rc5
```

Technical details

A vulnerability exists in Roundcube Webmail's HTML email rendering engine due to insufficient sanitization of Cascading Style Sheets (CSS). Specifically, the application fails to properly restrict the use of the '!important' declaration within CSS styles. An unauthenticated remote attacker can exploit this by sending a crafted HTML email that leverages '!important' to bypass existing mitigations designed to prevent 'fixed-position' elements from overlaying the webmail UI. This is classified as an Incorrect Resource Transfer Between Spheres (CWE-669). The issue is resolved in versions 1.5.14, 1.6.14, and 1.7-rc5.

Affected products

Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14

Identifiers

CVE-2026-35544
GHSA-xpqh-grpw-4xmg

Timeline

2026-03-18: patched: Security updates released for 1.5, 1.6, and 1.7 branches
2026-04-03: disclosed: Initial CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.