Protection mechanism failure in Roundcube Webmail - #VU156142
Published: October 19, 2026
Vulnerability identifier: #VU156142
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass remote content blocking and potentially disclose information through external content requests.
The vulnerability exists due to insufficient handling of CSS escape sequences in remote content filtering when processing FuncIRI attributes. A remote attacker can supply crafted FuncIRI attribute values containing CSS escapes to evade filtering and cause external content to load despite the blocking policy.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5