SB2026090618 - Multiple vulnerabilities in Roundcube Webmail
Published: September 6, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle CSS declarations.
The vulnerability exists due to improper neutralization of special elements in CSS declaration handling when emitting unencoded ampersands. A remote attacker can supply crafted CSS content to smuggle CSS declarations.
2) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject CSS properties.
The vulnerability exists due to improper neutralization of special elements in body background attribute handling when processing HTML content. A remote attacker can supply a crafted body background attribute to inject CSS properties.
3) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject email headers.
The vulnerability exists due to improper neutralization of CRLF sequences in subject field handling when composing an email. A remote user can include a bare carriage return in a subject field to inject email headers.
4) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject email headers.
The vulnerability exists due to improper neutralization of CRLF sequences in recipient display name handling when composing an email. A remote user can include a C-escape carriage return in a recipient display name to inject email headers.
5) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject email headers.
The vulnerability exists due to improper neutralization of special elements in identity organization field handling when composing an email. A remote user can supply a crafted organization field to inject email headers.
6) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script.
The vulnerability exists due to improper neutralization of input during web page generation in attachment URL handling when processing TNEF MIME tag input. A remote attacker can send an email containing a crafted TNEF MIME tag to execute arbitrary script.
No user interaction is required.
7) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script.
The vulnerability exists due to improper neutralization of input during web page generation in the HTML editor when processing text/enriched part content. A remote attacker can supply crafted text/enriched part content to execute arbitrary script.
8) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify another user\'s contact group membership.
The vulnerability exists due to improper authorization in SQL address book contact group membership handling when adding or removing group members. A remote user can add or remove contacts from another user\'s group to modify another user\'s contact group membership.
9) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass stylesheet URL validation.
The vulnerability exists due to improper input validation in is_local_url() when validating a stylesheet URL with a trailing-dot fully qualified domain name. A remote attacker can supply a stylesheet URL containing a trailing-dot fully qualified domain name to bypass stylesheet URL validation.
10) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass remote content blocking.
The vulnerability exists due to improper input validation in FuncIRI attribute handling when processing CSS escapes. A remote attacker can supply FuncIRI attributes containing CSS escapes to bypass remote content blocking.
11) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass remote content blocking.
The vulnerability exists due to improper input validation in SVG SMIL source animation handling when processing SVG content. A remote attacker can supply SVG content containing a SMIL source animation to bypass remote content blocking.
12) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper input validation in the Roundcube CSS proxy when processing hexadecimal IPv6-mapped IPv4 addresses. A remote attacker can supply a hexadecimal IPv6-mapped IPv4 address to perform server-side request forgery.
Remediation
Install update from vendor's website.