Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
Date: 2026-04
Affected: composer/roundcube/roundcubemail
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-35539
CVE-2026-35544
CWE: CWE-669
CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.


Mitigations:

Architectural layers (MAESTRO):