Roundcube Webmail versions 1.6.x (from 1.6.0 up to 1.6.16) and 1.7.x (before 1.7.1) contain a vulnerability due to insufficient sanitization of CSS in HTML emails. This flaw can enable SSRF or information disclosure by allowing maliciously crafted stylesheet links to access internal network resources. The vulnerability is classified under CWE-918 (Server-Side Request Forgery) and has a CVSS 3.1 base score of 7.2, indicating high severity. The issue stems from an insufficient fix applied for CVE-2026-35540. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker to cause the Roundcube Webmail server to make unauthorized requests to internal network resources or disclose sensitive information via crafted CSS links in HTML emails. The impact includes potential information leakage and SSRF attacks, which may facilitate further internal network reconnaissance or exploitation. There is no indication of known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Roundcube's official channels for updates. Until a fix is available, consider restricting or filtering HTML email content or disabling automatic loading of external stylesheets in emails as a temporary mitigation.