CVE-2026-35539 in Webmail

Resumen (Inglés)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsable

MITRE

Reservar

2026-04-03

Divulgación

2026-04-03

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
355062	Roundcube Webmail HTML Attachment HTML injection	79	No está definido	Arreglo oficial	CVE-2026-35539

Fuentes

• MITRE
• NVD
• CVE Details