GHSA-xpqh-grpw-4xmg

Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-35544

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	roundcube/roundcubemail	>= 1.7-beta, < 1.7-rc5	1.7-rc5

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-35544 advisory
https://github.com/roundcube/roundcubemail/commit/099009b9c8e1d3c636fb9a5af72f7c2596018662 web
https://github.com/roundcube/roundcubemail/commit/226811a1c974271dbedca72672923abaff8191c0 web
https://github.com/roundcube/roundcubemail/commit/57dec0c127b98e0c8e3b9c26c80049b9c4bcaea7 web
https://github.com/roundcube/roundcubemail package
https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 web
https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 web
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 web
https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 web