Description (CNA)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Roundcube / Webmail | affected 1.6.0 before 1.6.18; affected 1.7.0 before 1.7.3 |
CWE
CWE-79
References
- https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
- https://github.com/roundcube/roundcubemail/commit/62d33c8a0dc3fd0dd03984220dc9709e8e0de43b
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
- https://github.com/roundcube/roundcubemail/commit/a2334990c02f7cb77b1a8d6fa97fcd9e1b5cd1fb
ADP enrichment
No English description supplied.
No references supplied.