CVE-2026-75006
published 2026-08-17CVE-2026-75006: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or…
PriorityP430medium5.8CVSS 3.1
AVNACLPRNUINSCCNILAN
EPSS
0.42%
35.0th percentile
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.18 | 1.6.18 |
| roundcube | webmail | >= 1.7.0 < 1.7.3 | 1.7.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Roundcube Webmail up to 1.6.17/1.7.2 CSS Sanitization server-side request forgery (Nessus ID 341564 / WID-SEC-2026-2880)
vuldb·2026-08-31·CVSS 5.8
CVE-2026-75006 [MEDIUM] Roundcube Webmail up to 1.6.17/1.7.2 CSS Sanitization server-side request forgery (Nessus ID 341564 / WID-SEC-2026-2880)
A vulnerability was found in Roundcube Webmail up to 1.6.17/1.7.2. It has been classified as critical. The impacted element is an unknown function of the component CSS Sanitization. The manipulation leads to server-side request forgery.
This vulnerability is uniquely identified as CVE-2026-75006. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if styleshee
ghsa_unreviewed·2026-08-17·CVSS 6.5
CVE-2026-75006 [MEDIUM] CWE-918 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if styleshee
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/roundcube/roundcubemail/commit/7e10ca0110b7c9aa1b7850b843bb6625e47bbe00https://github.com/roundcube/roundcubemail/commit/8a92380b06b5df1481e034c4f40d6a6546c21223https://github.com/roundcube/roundcubemail/commit/92f85c883594e5be757154f94548a9ba903455c9https://github.com/roundcube/roundcubemail/commit/c111b72950cd2bf57d6b86cd129568d90403322dhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.18https://github.com/roundcube/roundcubemail/releases/tag/1.7.3https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
2026-08-17
Published