DeutschShown in its original language — a full translation is planned for a future version.
Roundcube: Mehrere Schwachstellen
view advisory published 2026-03-18
Ein Angreifer kann mehrere Schwachstellen in Roundcube ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, und um Informationen offenzulegen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35545US | high8.2 | — | ||
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to info… | ||||
| CVE-2026-35544US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position m… | ||||
| CVE-2026-35543US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail mess… | ||||
| CVE-2026-35542US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an… | ||||
| CVE-2026-35541US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password chan… | ||||
| CVE-2026-35540US | medium6.5 | — | ||
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Dis… | ||||
| CVE-2026-35539US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text… | ||||
| CVE-2026-35538US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search. | ||||
| CVE-2026-35537US | high7.5 | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by u… | ||||
02
references
External citations — patches, advisories, analysis.
- Debian Security Advisory DLA-4604 vom 2026-05-28external
- Debian Security Advisory DLA-4693 vom 2026-07-22external
- Debian Security Advisory DLA-4760 vom 2026-08-29external
- Debian Security Advisory DSA-6196 vom 2026-04-04external
- openSUSE Security Update OPENSUSE-SU-2026:0144-1 vom 2026-04-20external
- openSUSE Security Update OPENSUSE-SU-2026:0141-1 vom 2026-04-20external
- openSUSE Security Update OPENSUSE-SU-2026:20586-1 vom 2026-04-21external
- Roundcube Security updates 1.7-rc5, 1.6.14 and 1.5.14 vom 2026-03-18external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan