Roundcube: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 4.7
  CVE-2026-26079

  Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comm…

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  Feb 11, 2026
• Medium 4.3
  CVE-2026-25916 Public exploit

  Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

  Roundcube Webmail roundcube roundcube Debian Ubuntu
  Feb 9, 2026

Revision history

1. 2026-04-29 #5

   Neue Updates von Ubuntu aufgenommen

2. 2026-03-08 #4

   Neue Updates von openSUSE aufgenommen

3. 2026-02-16 #3

   Neue Updates von Debian aufgenommen

4. 2026-02-10 #2

   CVE ergänzt

5. 2026-02-09 #1

   Initiale Fassung

References

• NULL CATHEDRAL Report + PoC vom 2026-02-09
  https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/
• Red Hat Bugtracker #2437845 vom 2026-02-09
  https://bugzilla.redhat.com/show_bug.cgi?id=2437845
• Roundcube Security updates 1.6.13 and 1.5.13 vom 2026-02-09
  https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13
• Debian Security Advisory DSA-6137 vom 2026-02-17
  https://lists.debian.org/debian-security-announce/2026/msg00046.html
• Debian Security Advisory DLA-4480 vom 2026-02-17
  https://lists.debian.org/debian-lts-announce/2026/02/msg00019.html
• openSUSE Security Update OPENSUSE-SU-2026:20323-1 vom 2026-03-06
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YOERSL4O45LXQ6A5T2OVJOYHIVEHXZ5U/
• Ubuntu Security Notice USN-8223-1 vom 2026-04-29
  https://ubuntu.com/security/notices/USN-8223-1