Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

An attacker exploiting this SSRF vulnerability could craft malicious HTML emails containing stylesheet links pointing to internal network hosts. When a user opens such an email in Roundcube Webmail, the application would attempt to fetch the linked stylesheet, effectively making a request to the specified internal resource. This could lead to information disclosure if the internal resource exposes sensitive data, or allow an attacker to interact with internal services without proper authentication. The blast radius extends to any internal services accessible via HTTP/HTTPS from the Roundcube server, potentially including databases, internal APIs, or other critical infrastructure. Successful exploitation could allow an attacker to map the internal network and identify further attack vectors.

Organizations using Roundcube Webmail for internal or external email communication are at risk. Shared hosting environments where multiple users share the same Roundcube instance are particularly vulnerable, as a compromised user account could be leveraged to send malicious emails to other users. Legacy Roundcube deployments running older, unpatched versions are also at heightened risk.

• php / server:

find /var/www/roundcube/ -name 'config.inc.php' -exec grep -i 'disable_html_formatting' {} + 

• generic web:

curl -I http://your-roundcube-server/ | grep Content-Type

• generic web:

 grep -i "stylesheet url" /var/log/apache2/access.log

1. 2026-04-03Disclosure

   disclosure

1. Reserviert2026-04-03
2. Veröffentlicht2026-04-03
3. Geändert2026-04-04
4. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-35540 is to upgrade Roundcube Webmail to version 1.7-rc5 or later, which includes the necessary CSS sanitization fixes. If immediate upgrading is not feasible, consider implementing a temporary workaround by disabling HTML email rendering in Roundcube. This can be achieved by configuring Roundcube to only display plain text emails. Additionally, implement strict firewall rules to restrict outbound connections from the Roundcube server to only necessary external resources. Monitor Roundcube logs for unusual HTTP requests originating from within the server’s network interface. After upgrading, confirm the fix by sending a test email containing a stylesheet link to an internal resource and verifying that the request is blocked or handled securely.