CVE-2026-35544: Medium severity Roundcube Webmail vulnerability
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/roundcube/roundcubemailto a version that resolves this vulnerability.Fixed in 1.7-rc5 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.5.14 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35544?
CVE-2026-35544 is classified as a high severity vulnerability due to insufficient CSS sanitization in Roundcube Webmail.
How do I fix CVE-2026-35544?
To fix CVE-2026-35544, upgrade to Roundcube Webmail version 1.5.14, 1.6.14, or later.
Which versions of Roundcube Webmail are affected by CVE-2026-35544?
Versions of Roundcube Webmail prior to 1.5.14 and 1.6.14 are affected by CVE-2026-35544.
What type of attack does CVE-2026-35544 enable?
CVE-2026-35544 may allow an attacker to bypass fixed-position mitigations through malicious HTML e-mail messages.
Is there a workaround for CVE-2026-35544?
There are no known workarounds for CVE-2026-35544; upgrading is the recommended approach to mitigate the issue.