CVE-2026-35544: 
PHP vulnerability analysis and mitigation

CVE-2026-35544 is a CSS sanitization bypass vulnerability in Roundcube Webmail that allows attackers to circumvent fixed-position overlay protections via the use of !important CSS declarations in HTML email messages. It affects Roundcube Webmail versions before 1.5.14 and versions 1.6.0 through 1.6.13. The vulnerability was reported by security researcher nullcathedral and patched on March 18, 2026, with public disclosure on April 3, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Roundcube Release).

The root cause is improper validation of unsafe equivalence in CSS input (CWE-1289) combined with incorrect resource transfer between spheres (CWE-669). Roundcube's CSS sanitizer in rcube_utils.php used a strict equality check (strcasecmp($value, 'fixed') === 0) to detect and neutralize position: fixed declarations by converting them to position: absolute. This check failed to account for the !important modifier, meaning a value like fixed !important would not match the exact string fixed and would pass through unsanitized. The fix changed the comparison to use stripos($value, 'fixed') !== false, which correctly detects fixed anywhere within the value string (Commit 099009b, Commit 226811a).

Successful exploitation allows an attacker to craft a malicious HTML email that bypasses Roundcube's fixed-position overlay mitigation, enabling elements to be rendered with position: fixed in the victim's browser. This can be used to create deceptive UI overlays — such as fake login forms or phishing prompts — that visually obscure the legitimate Roundcube interface when a user views the malicious email. The primary risk is integrity impact through social engineering, phishing, and potential credential theft; there is no direct confidentiality or availability impact (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.034%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Craft malicious HTML email: Compose an HTML email containing a CSS block that uses position: fixed !important to position an overlay element, e.g., <style>.overlay { position: fixed !important; top: 0; left: 0; width: 100%; height: 100%; z-index: 9999; background: white; }</style>.
2. Embed deceptive content: Within the fixed-position element, include a convincing phishing payload such as a fake Roundcube login form requesting credentials or a spoofed security alert.
3. Send to target: Deliver the crafted email to a victim using a Roundcube Webmail instance running a vulnerable version (before 1.5.14 or 1.6.0–1.6.13).
4. Victim opens email: When the victim opens the email in Roundcube, the CSS sanitizer fails to strip the !important modifier, allowing the position: fixed style to render in the browser.
5. Overlay displayed: The fixed-position overlay covers the Roundcube UI, presenting the attacker's deceptive content and potentially capturing credentials or tricking the user into performing unintended actions (Commit 099009b, GitHub Advisory).

• Email Content: Inbound HTML emails containing CSS with position: fixed !important or similar !important-modified position declarations in <style> blocks.
• Logs: Roundcube mail logs showing emails from unexpected or external senders with HTML content containing inline CSS referencing fixed !important.
• User Reports: Users reporting unexpected overlays, fake login prompts, or unusual visual elements appearing when reading specific emails in Roundcube.

Roundcube has released patched versions addressing this vulnerability: upgrade to 1.5.14 (for 1.5.x users), 1.6.14 (for 1.6.x users), or 1.7-rc5 or later. These releases were published on March 18, 2026. As a temporary workaround if immediate patching is not feasible, administrators can disable HTML email rendering in Roundcube or enforce plain-text email display to eliminate the attack surface. Reviewing and restricting inbound HTML email content via a mail gateway is also advisable (Roundcube Release, 1.6.14 Release, 1.5.14 Release).

The vulnerability was reported by security researcher nullcathedral, who also identified several other security issues addressed in the same Roundcube release batch, including remote image blocking bypasses. Roundcube released the fix as part of a broader security update on March 18, 2026, covering eight distinct vulnerabilities. Coverage has appeared on Linux security news aggregators and German-language security outlets, reflecting routine community attention to Roundcube security updates (1.6.14 Release, Roundcube Release).