GHSA-x4q5-8j5g-hpjc

Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-35539

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	roundcube/roundcubemail	>= 1.7-beta, < 1.7-rc5	1.7-rc5

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-35539 advisory
https://github.com/roundcube/roundcubemail/commit/10a6d1fa8acac85c727b0a6ae4a6642bfa27bea1 web
https://github.com/roundcube/roundcubemail/commit/1b30edf5369668c92fe91dae3d52e477c808aa4f web
https://github.com/roundcube/roundcubemail/commit/d742954ccbcdee7020f8f2e7c49ce0fca5a0efab web
https://github.com/roundcube/roundcubemail package
https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 web
https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 web
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 web
https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 web