Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-35540 · ADVISORY
• roundcube/roundcubemail commit 27ec6cc · WEB
• roundcube/roundcubemail commit 579b68e · WEB
• roundcube/roundcubemail · PACKAGE
• roundcube/roundcubemail release 1.6.14 · WEB
• roundcube/roundcubemail release 1.7-rc5 · WEB
• roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 · WEB

roundcube/roundcubemail のその他の脆弱性

• CVE-2026-35545高 8.2An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in …
• CVE-2026-35544中 5.3An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail…
• CVE-2026-35543中 5.3An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (wi…
• CVE-2026-35542中 5.3An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted backg…
• CVE-2026-35541中 4.2An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to ty…