Description
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-2445 Vulnerability (CVE-2013-2445)
WordPress Plugin MasterStudy LMS-for Online Courses and Education SQL Injection (3.2.5)
WordPress Plugin Contextual Related Posts Cross-Site Scripting (3.3.0)
WordPress Plugin easyping-website subscriptions done right PHP Object Injection (0.0.1)
WordPress Plugin WordPress Content Slide Multiple Vulnerabilities (1.4.2)