CVE-2026-35542 in Webmail

Resumen (Inglés)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsable

MITRE

Reservar

2026-04-03

Divulgación

2026-04-03

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
355056	Roundcube Webmail BODY Element divulgación de información	669	No está definido	Arreglo oficial	CVE-2026-35542

Fuentes

• MITRE
• NVD
• CVE Details