VULNERABILITY INTELLIGENCE

CVE-2026-75006

CVSS score5.8 MEDIUM

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-08-17

Last modified2026-09-08

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-3…