CVE-2026-26079: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-26079 is a Cascading Style Sheets (CSS) injection vulnerability in Roundcube Webmail caused by improper handling of CSS comments. It affects Roundcube Webmail versions before 1.5.13 and 1.6.x before 1.6.13. The vulnerability was reported by CERT Polska and disclosed on February 11, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause lies in the mod_css_styles() function within program/lib/Roundcube/rcube_utils.php, which failed to properly strip CSS comments (/* ... */) before processing email-embedded stylesheets (CWE-829: Inclusion of Functionality from Untrusted Control Sphere; CWE-79: Cross-site Scripting). An attacker could craft a malicious email containing CSS with specially structured comments that bypass the sanitization logic, allowing injected stylesheet rules to be rendered in the victim's browser when they view the email. The fix, committed by the Roundcube maintainer in response to the CERT Polska report, adds a dedicated remove_css_comments() call prior to escape-sequence checks and introduces a secondary guard that rejects CSS still containing comment markers after sanitization (GitHub Commit). No authentication is required to send the malicious email, but user interaction (opening the email) is necessary to trigger the injection.

Successful exploitation allows an unauthenticated attacker to inject arbitrary CSS into the Roundcube webmail interface of any user who views the crafted email, resulting in low-level confidentiality impact through potential information disclosure (e.g., leaking sensitive UI data or session-related information via CSS-based side-channel techniques). Integrity and availability are not directly impacted. The changed scope (S:C) in the CVSS vector indicates the injected CSS can affect resources beyond the email rendering context, potentially influencing the broader webmail UI (Red Hat Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.043%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft malicious email: Compose an HTML email containing an embedded <style> block with CSS that uses comment syntax (e.g., /* ... */) to smuggle malicious CSS rules past Roundcube's sanitization filter.
2. Send to target: Deliver the crafted email to a victim's Roundcube-hosted mailbox. No authentication to the target system is required — only a valid email delivery path.
3. Wait for user interaction: The vulnerability triggers when the victim opens or previews the email in their Roundcube webmail interface, causing the injected CSS to be rendered in their browser session.
4. Achieve CSS injection: The injected stylesheet rules execute within the webmail page context, potentially enabling UI redressing, data exfiltration via CSS attribute selectors (e.g., leaking form field values or CSRF tokens through crafted background-image URL requests), or phishing overlays (GitHub Commit).

• Network: Unusual outbound HTTP/HTTPS requests from the Roundcube server or user browsers to attacker-controlled domains triggered by CSS background-image, @import, or url() directives embedded in email content.
• Logs: Roundcube mail rendering logs showing emails with <style> blocks containing /* comment sequences that were not stripped; web server access logs showing requests to external URLs originating from webmail page loads.
• File System: No file-system artifacts expected for this CSS injection vector, as exploitation is client-side.
• Process/Application: Anomalous CSS content in rendered email bodies visible via browser developer tools, particularly style blocks with obfuscated or comment-wrapped rules.

Roundcube has released patched versions addressing this vulnerability: 1.5.13 for the 1.5.x branch and 1.6.13 for the 1.6.x branch. Administrators should upgrade immediately. Distribution-specific packages are available for Debian (DSA-6137-1, DLA-4480-1), Fedora, openSUSE, and Ubuntu (USN-8223-1). As a temporary workaround where patching is not immediately possible, implement Content Security Policy (CSP) headers to restrict CSS loading to trusted sources, and apply network-level controls to filter inbound email from untrusted sources (Red Hat Bugzilla, GitHub Commit).

The vulnerability was reported to Roundcube by CERT Polska, which is noted directly in the fix commit message (GitHub Commit). Red Hat tracked the issue via Bugzilla and assigned it medium severity. The OSS-Security mailing list carried a disclosure post (seclists.org/oss-sec/2026/q1/196). Coverage was also noted on security aggregators including Tenable (multiple Nessus plugins), Qualys, and Linux security news outlets, reflecting routine community attention appropriate for a medium-severity webmail vulnerability.