Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2026-35540
CVE-2026-35540:
PHP vulnerability analysis and mitigation
Overview
CVE-2026-35540 is an insufficient CSS sanitization vulnerability in Roundcube Webmail that can lead to Server-Side Request Forgery (SSRF) or Information Disclosure when HTML email messages contain stylesheet links pointing to local network hosts. It affects Roundcube Webmail versions 1.6.0 through 1.6.13 (and 1.7-beta through 1.7-rc4 in the pre-release branch). The vulnerability was reported by Georgios Tsimpidas (aka Frey) and patched on March 18, 2026, with public disclosure on April 3, 2026 (Github Advisory, Roundcube Release). The CVSS v3.1 base score is 5.4 (Moderate) per the GitHub Advisory Database, or 6.5 (Medium) per Feedly's estimate (Github Advisory).
Technical details
The root cause is insufficient sanitization of CSS stylesheet links embedded in HTML email messages (CWE-669: Incorrect Resource Transfer Between Spheres; CWE-918: Server-Side Request Forgery). Specifically, the washtml_link_callback function in program/actions/mail/index.php previously allowed any HTTP/HTTPS URL in <link> tags to be fetched by the server without checking whether the target was a local/private network address. The fix introduced a new rcube_utils::is_local_url() method that blocks URLs resolving to RFC-1918 private ranges (10.x, 172.16.x, 192.168.x), loopback (127.x, ::1), link-local (169.254.x), and localhost; additionally, HTTP redirects were disabled in the CSS fetching client to prevent redirect-based bypasses (Roundcube Commit 27ec6cc, Roundcube Commit 579b68e). No user interaction is required for exploitation — the server-side fetch occurs automatically when the email is processed.
Impact
An attacker who can send email to a Roundcube user can craft an HTML message with a <link rel="stylesheet"> tag pointing to an internal network host (e.g., http://192.168.1.1/admin). When the Roundcube server processes the email, it fetches the URL server-side, potentially exposing internal services, metadata endpoints (such as cloud provider IMDS), or other resources not directly reachable from the internet. This results in low-level confidentiality and integrity compromise — an attacker may infer the existence and behavior of internal hosts, and in some configurations, trigger unintended actions on internal services (Github Advisory, Feedly).
Exploitability
As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.017% (5th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.
Exploitation steps
- Craft malicious email: Compose an HTML email containing a
<link rel="stylesheet" href="http://192.168.1.1/internal-resource">tag (or targeting any private/local IP, e.g.,http://169.254.169.254/latest/meta-data/for cloud IMDS) in the email body or<head>section. - Send to target: Deliver the crafted email to a user account on a vulnerable Roundcube instance (versions 1.6.0–1.6.13).
- Server-side fetch triggered: When the Roundcube server processes the email for display, the
washtml_link_callbackfunction detects the<link>tag and issues an HTTP GET request from the server to the attacker-specified URL without validating whether it is a local/private address. - Observe response or side effects: The attacker can infer whether the internal host responded (e.g., via timing, error messages, or by hosting a logging server on a reachable external IP if redirect-based techniques are used). In pre-patch versions, HTTP redirects were also followed, enabling redirect chains to reach internal resources.
- Exfiltrate information: Depending on the internal service, the attacker may obtain sensitive data (e.g., cloud metadata tokens, internal API responses) that the Roundcube server fetches and potentially reflects (Roundcube Commit 27ec6cc, Github Advisory).
Indicators of compromise
- Network: Outbound HTTP/HTTPS requests from the Roundcube server to RFC-1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.1, ::1), link-local addresses (169.254.0.0/16), or cloud metadata endpoints (e.g., 169.254.169.254) originating from the web server process.
- Network: Outbound requests to
localhostorlocalhost.localdomainfrom the Roundcube PHP process. - Logs: Web server or application logs showing requests to
program/actions/utils/modcss.phpwithmodcssurlssession parameters referencing internal IP addresses or hostnames. - Logs: HTTP client error logs or PHP error logs indicating failed connections to internal hosts triggered during email rendering.
- File System: Session data (
$_SESSION['modcssurls']) containing entries with internal/private URLs, which may be observable in session storage (files, Redis, Memcache).
Mitigation and workarounds
Roundcube released patched versions on March 18, 2026: 1.6.14 (stable branch) and 1.7-rc5 (pre-release branch); version 1.5.14 was also released for the legacy 1.5.x branch (Roundcube Release 1.6.14, Roundcube Release 1.7-rc5). All installations running Roundcube 1.6.0–1.6.13 should upgrade to 1.6.14 or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Administrators should also monitor outbound HTTP requests from the Roundcube server to internal network ranges as a detection measure while patching is underway (Github Advisory).
Community reactions
Red Hat tracked the vulnerability via Bugzilla and published a security advisory (Red Hat Advisory). Debian issued a security update for the roundcube package, with announcements on the debian-lts-announce mailing list. Fedora and other Linux distributions also issued updates. The vulnerability was reported by Georgios Tsimpidas (aka Frey) of i0.rs, who is credited in the official Roundcube release notes (Roundcube Release 1.6.14). Community coverage was moderate, with security aggregators and Linux news sites reporting the update.
Additional resources
Linux Distribution fix status
Fix availability across major Linux distributions and their releases.
bookworm
roundcube: 1.6.5+dfsg-1+deb12u8
sid
roundcube: 1.6.14+dfsg-1
trixie
roundcube: 1.6.15+dfsg-0+deb13u1
Source: This report was generated using AI
Related PHP vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management