CVE-2026-35539: Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
Published Apr 3, 2026
·Updated
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
Other sources
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
— Packagist
Affected Software
4 affected componentsFixes available
composer/roundcube/roundcubemail>=1.7-beta<1.7-rc5
1.7-rc5
Roundcube Webmail<1.5.14
Roundcube Webmail>=1.6.0<1.6.14
composer/roundcube/roundcubemail>=1.7-beta, <1.7-rc5
1.7-rc5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/roundcube/roundcubemailto a version that resolves this vulnerability.Fixed in 1.7-rc5
Event History
Apr 3, 2026
CVE Published
via MITRE·03:39 AM
Data Sourced
via MITRE·03:39 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 AM
Data Sourced
via GitHub·06:31 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Packagist·06:31 AM
DescriptionSeverityAffected Software