Search: CVE-2026-35540

CVE-2026-35540 is a medium severity vulnerability in Roundcube Webmail versions before 1.6.14. It involves insufficient sanitization of CSS in HTML email messages, which may allow server-side request forgery (SSRF) or information disclosure if stylesheet links reference local network hosts. The vulnerability affects Roundcube Webmail 1.6.0 and has a CVSS score of 5.4. No official patch or remediation information is currently available from the vendor. There are no known exploits in the wild at this time.