Improper Encoding or Escaping of Output in Roundcube Webmail - #VU124141
Published: March 19, 2026 / Updated: March 19, 2026
Vulnerability identifier: #VU124141
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass fixed position CSS mitigation by using !important declarations.
The vulnerability exists due to improper output neutralization in CSS filtering mechanism when processing HTML email content. A remote attacker can send a specially crafted email containing styles with "!important" declarations to override fixed position restrictions.
This can be exploited to manipulate email display and potentially enable phishing or UI spoofing attacks.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.5.14, 1.6.14