High severity7.2NVD Advisory· Published Aug 17, 2026
CVE-2026-74998
CVE-2026-74998
Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
Affected products
1- Range: <1.6.18, <1.7.3
Patches
Vulnerability mechanics
References
5- github.com/roundcube/roundcubemail/commit/62d33c8a0dc3fd0dd03984220dc9709e8e0de43bnvd
- github.com/roundcube/roundcubemail/commit/a2334990c02f7cb77b1a8d6fa97fcd9e1b5cd1fbnvd
- github.com/roundcube/roundcubemail/releases/tag/1.6.18nvd
- github.com/roundcube/roundcubemail/releases/tag/1.7.3nvd
- roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3nvd
News mentions
0No linked articles in our index yet.