CVE-2026-26079

Published: Feb 11, 2026Modified: Jun 17, 2026Deferred

4.7

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

Related CWEs

Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (9)

https://github.com/roundcube/roundcubemail/commit/1f4c3a5af5033747f9685a8a395dbd8228d19816

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/commit/2b5625f1d2ef7e050fd1ae481b2a52dc35466447

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/commit/53d75d5dfebef235a344d476b900c20c12d52b01

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/commit/5a3315cce587e0be58335d11ff9a5571c90494a5

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/commit/bf89cbaa5897d8ad62e8057d9a3f6babb90b7954

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/commit/c15f5dbf093a497e19a749b20e7f8fb5a9c24cde

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/releases/tag/1.5.13

Source: cve@mitre.org

https://github.com/roundcube/roundcubemail/releases/tag/1.6.13

Source: cve@mitre.org

https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13

Source: cve@mitre.org

Timeline

No history available yet.