Loading vulnerability…
SSRF through insufficient CSS sanitization in Roundcube Webmail
CVE-2026-35540 is an insufficient CSS sanitization vulnerability in Roundcube Webmail 1.6.0 through versions before 1.6.14. Malicious stylesheet links embedded in HTML email messages can cause server-side requests to local network hosts, potentially resulting in information disclosure. The initial March 2026 fix blocked private addresses but failed to account for alternative address representations and domain names resolving to private addresses. Subsequent related fixes were also found insufficient.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause the Roundcube server to issue attacker-directed requests, including requests to local network hosts, and may disclose information. Internal resources reachable from the server may therefore be exposed to requests that an external attacker could not make directly. The specific information recoverable is not established.
If you can’t patch tonight, do this now.
Until a fixed version can be deployed, reduce exposure by disabling HTML email rendering where feasible, enforcing strict sanitization of HTML and CSS content in messages, and preventing the application from making outbound requests to internal or sensitive network ranges. Network egress controls and segmentation can limit SSRF impact by blocking access from the webmail environment to local metadata services, loopback addresses, and internal administrative interfaces.
Patch, then assume compromise.
Upgrade to Roundcube Webmail 1.6.18 or later on the 1.6 branch, or 1.7.3 or later on the 1.7 branch, to incorporate the later fixes for this vulnerability class. Version 1.6.14 contained the initial fix but should not be treated as sufficient because of subsequent bypasses. For Debian 12 bookworm, upgrade the Roundcube packages to 1.6.5+dfsg-1+deb12u12 or a later security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.