CVE-2026-35539: Roundcube Webmail Insufficient HTML Attachment Sanitization in Preview Mode
Summary
CVE-2026-35539: Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode. Affects roundcube/roundcubemail versions >= 1.7-beta, < 1.7-rc5. Fixed in 1.7-rc5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundcube Webmail is an open-source web-based email client that provides a user-friendly interface for managing emails. It supports various features such as MIME support, address book integration, and customizable skins. However, prior to versions 1.5.14 and 1.6.14, Roundcube was vulnerable to an XSS attack due to insufficient sanitization of HTML attachments in preview mode, which could potentially compromise user security.
Vulnerability Detail
The vulnerability arises from inadequate sanitization of HTML content in attachments when users preview them. This flaw allows attackers to embed malicious scripts within HTML attachments. When a victim previews such an attachment, the malicious script executes in the context of the user's session, leading to potential data theft, session hijacking, or other malicious actions. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) and has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.7-rc5
This is the first release that contains the fix.
composer require roundcube/roundcubemail:1.7-rc5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid previewing text/html attachments until the software is updated. Additionally, consider disabling HTML attachments if possible to mitigate the risk until a patch is applied.
Conclusion
The vulnerability CVE-2026-35539 in Roundcube Webmail highlights the importance of proper sanitization of HTML content in attachments. Users are strongly advised to update to the latest versions to mitigate the risk of XSS attacks. For those unable to update immediately, following the provided workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for roundcube/roundcubemail →
FAQ
CVE-2026-35539 is a vulnerability in Roundcube Webmail that allows for XSS attacks due to insufficient sanitization of HTML attachments in preview mode.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid previewing HTML attachments and consider disabling them until the vulnerability is patched.
The vulnerability can lead to data theft, session hijacking, and unauthorized actions performed in the context of the user's session.
You can visit the official Roundcube website or their GitHub repository for more information about features, updates, and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundcube/roundcubemail.
