CVE-2026-74998

Published: Aug 17, 2026Modified: Sep 8, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.7

Source: MITRE (Secondary)

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

Affected (2)

Products: Roundcube: Webmail

Roundcube

1 product

Webmail

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Roundcube Webmail	From 1.6.0 to 1.6.18
Roundcube Webmail	From 1.7.0 to 1.7.3

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (5)

https://github.com/roundcube/roundcubemail/commit/62d33c8a0dc3fd0dd03984220dc9709e8e0de43b

Source: cve@mitre.org

Patch

https://github.com/roundcube/roundcubemail/commit/a2334990c02f7cb77b1a8d6fa97fcd9e1b5cd1fb

Source: cve@mitre.org

Patch

https://github.com/roundcube/roundcubemail/releases/tag/1.6.18

Source: cve@mitre.org

Release Notes

https://github.com/roundcube/roundcubemail/releases/tag/1.7.3

Source: cve@mitre.org

Release Notes

https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.