CVE-2026-35540: SSRF in Roundcube Webmail

An attacker exploiting this SSRF vulnerability could craft malicious HTML emails containing stylesheet links pointing to internal network hosts. When a user opens such an email in Roundcube Webmail, the application would attempt to fetch the linked stylesheet, effectively making a request to the specified internal resource. This could lead to information disclosure if the internal resource exposes sensitive data, or allow an attacker to interact with internal services without proper authentication. The blast radius extends to any internal services accessible via HTTP/HTTPS from the Roundcube server, potentially including databases, internal APIs, or other critical infrastructure. Successful exploitation could allow an attacker to map the internal network and identify further attack vectors.

1. Reserved2026-04-03
2. Published2026-04-03
3. Modified2026-04-04
4. EPSS updated2026-04-10

The primary mitigation for CVE-2026-35540 is to upgrade Roundcube Webmail to version 1.7-rc5 or later, which includes the necessary CSS sanitization fixes. If immediate upgrading is not feasible, consider implementing a temporary workaround by disabling HTML email rendering in Roundcube. This can be achieved by configuring Roundcube to only display plain text emails. Additionally, implement strict firewall rules to restrict outbound connections from the Roundcube server to only necessary external resources. Monitor Roundcube logs for unusual HTTP requests originating from within the server’s network interface. After upgrading, confirm the fix by sending a test email containing a stylesheet link to an internal resource and verifying that the request is blocked or handled securely.