CVE-2026-74998 in Roundcube
Summary
by MITRE • 08/17/2026
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.18 and 1.7.x prior to 1.7.3 stems from a failure to properly validate responses received by the CSS proxy component. This architectural flaw allows an attacker to manipulate how the browser interprets content served through this specific proxy mechanism, leading to significant security implications including cross-site scripting and information disclosure. The core issue lies in the lack of strict validation on the Content-Type headers or the actual body content returned from upstream sources when processed by the CSS proxy. In modern web architectures, proxies often act as intermediaries that fetch resources such as stylesheets, scripts, or images to optimize delivery or bypass certain client-side restrictions. When these responses are not rigorously checked for consistency between their declared MIME type and their actual content structure, they become susceptible to MIME sniffing attacks.
MIME sniffing is a technique where browsers attempt to determine the correct format of a file by analyzing its contents rather than relying solely on the Content-Type header provided by the server. While this feature was originally designed to improve usability for legacy web pages that lacked proper headers, it has become a common vector for security vulnerabilities when combined with insufficient input validation. In the context of Roundcube's CSS proxy, an attacker can craft a malicious response where the declared content type suggests one format, such as text/css, while the actual payload contains executable JavaScript or other dangerous markup. Because the browser performs its own sniffing and may override the server's stated MIME type based on heuristics, it might execute the embedded script within the context of the Roundcube application domain. This effectively bypasses Content Security Policy restrictions that typically prevent inline scripts from executing in stylesheets, thereby facilitating a stored or reflected cross-site scripting attack depending on how the malicious content is introduced into the proxy's data stream.
The operational impact of this vulnerability extends beyond simple script execution. An attacker who successfully exploits this flaw can inject arbitrary JavaScript code that runs with the privileges of the Roundcube webmail application. This enables the theft of sensitive user information, including email contents, contact lists, and session cookies, which could lead to full account compromise if combined with other attack vectors such as cross-site request forgery or token stealing. Furthermore, because CSS proxies are often used to serve static assets that might be cached by both the server and the client browser, a successful exploitation can have persistent effects. Malicious payloads embedded in these resources may remain active for extended periods, affecting multiple users who access their mailboxes through vulnerable instances of Roundcube. The information disclosure aspect arises from the ability to potentially read data from other origins or internal services that are accessible via the proxy but should not be exposed to untrusted contexts due to improper validation of the response integrity.
From a classification perspective, this vulnerability aligns with CWE-436, which refers to interpretation ambiguity, and more specifically CWE-79, known as Improper Neutralization of Input During Web Page Generation or Cross-site Scripting. The exploitation technique leverages browser behavior that falls under MITRE ATT&CK tactic T1059, Command and Control, particularly sub-techniques involving web protocols for delivering malicious payloads. It also relates to CWE-20, which covers improper input validation, as the root cause is the failure to ensure that external data meets expected security criteria before being processed or served. The lack of strict adherence to MIME type consistency represents a deviation from secure coding practices recommended by OWASP, particularly regarding the handling of user-controlled data and the configuration of web servers to prevent content sniffing attacks through explicit header enforcement.
Mitigation strategies primarily involve upgrading to Roundcube version 1.6.18 or later for the stable branch, or version 1.7.3 and above for the development branch, where these validation checks have been implemented. For organizations unable to immediately patch their systems, temporary mitigations include configuring web servers like Nginx or Apache to send strict Content-Type headers with no-sniff directives, such as X-Content-Type-Options: nosniff, which instructs browsers not to perform MIME sniffing and to strictly follow the declared content type. Additionally, implementing a Web Application Firewall rule that detects anomalies in CSS proxy responses could provide an additional layer of defense by blocking requests or responses that exhibit characteristics of malicious payloads disguised as stylesheets. Regular security audits focusing on how third-party modules handle external data streams are also recommended to identify similar vulnerabilities in other components of the webmail infrastructure, ensuring a holistic approach to securing the application against interpretation-based attacks.