CVE-2026-35542: Roundcube Webmail Info Disclosure Flaw

CVE-2026-35542 Overview

A security bypass vulnerability has been discovered in Roundcube Webmail that allows attackers to circumvent the remote image blocking feature. The vulnerability exists in versions prior to 1.5.14 and 1.6.14, where a specially crafted background attribute within a BODY element in an email message can bypass the security controls designed to prevent remote image loading. This bypass may lead to information disclosure or access-control circumvention.

Critical Impact

Remote image blocking bypass enables tracking of email recipients and potential information disclosure through external resource requests.

Affected Products

• Roundcube Webmail versions prior to 1.5.14
• Roundcube Webmail versions prior to 1.6.14
• Roundcube Webmail versions prior to 1.7-rc5

Discovery Timeline

• April 3, 2026 - CVE-2026-35542 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35542

Vulnerability Analysis

This vulnerability falls under CWE-669 (Incorrect Resource Transfer Between Spheres), indicating a flaw in how Roundcube Webmail handles resource access controls between different security domains. The remote image blocking feature in Roundcube is designed to prevent email messages from automatically loading external images, which is a common privacy and security measure to prevent email tracking and potential phishing attacks.

The vulnerability allows an attacker to bypass this protective mechanism by embedding a crafted background attribute within the HTML BODY element of a malicious email. When a victim opens the email, the webmail client fails to properly sanitize or block this particular attribute, resulting in an HTTP request to an attacker-controlled server.

This type of attack can be exploited over the network without any user authentication or interaction beyond opening the malicious email. The primary impact is unauthorized information disclosure, as attackers can confirm email delivery and receipt, track user activity, harvest IP addresses, and potentially fingerprint the victim's browser and system.

Root Cause

The root cause lies in incomplete input sanitization within Roundcube's HTML email rendering engine. While the application properly filters common methods of embedding remote images (such as <img> tags with src attributes), it fails to adequately handle the legacy background attribute on BODY elements. This oversight creates a gap in the remote image blocking implementation, allowing the deprecated HTML attribute to trigger external resource requests.

Attack Vector

The attack is executed via the network by sending a specially crafted email to a target user. The attacker constructs an HTML email where the BODY element contains a background attribute pointing to an attacker-controlled URL. When the victim views the email in their Roundcube webmail interface, the browser processes the BODY tag and attempts to load the background image resource, bypassing the intended remote image blocking protections.

The vulnerability can be exploited for email tracking, recipient enumeration, IP address harvesting, and potentially as a stepping stone for more sophisticated attacks when combined with other vulnerabilities.

Detection Methods for CVE-2026-35542

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests originating from the webmail server or client browsers to unknown external domains
• Email messages containing BODY elements with background attributes pointing to external URLs
• Web server logs showing requests with email tracking parameters or unique identifiers in URLs

Detection Strategies

• Implement email content analysis rules to detect BODY tags with background attributes containing external URLs
• Monitor network traffic for unexpected outbound connections triggered during email viewing sessions
• Deploy web application firewall (WAF) rules to inspect and block suspicious HTML constructs in incoming emails
• Review Roundcube access logs for patterns indicating exploitation attempts

Monitoring Recommendations

• Enable detailed logging for the Roundcube webmail application to capture email rendering events
• Set up alerts for outbound connections to newly registered or suspicious domains during email viewing
• Implement DNS query monitoring to detect resolution requests to attacker-controlled domains

How to Mitigate CVE-2026-35542

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.5.14, 1.6.14, or 1.7-rc5 immediately
• Review email logs for any suspicious emails containing unusual BODY tag attributes
• Consider temporarily disabling HTML email rendering if immediate patching is not possible
• Notify users about the vulnerability and advise caution when opening unexpected emails

Patch Information

Roundcube has released security updates addressing this vulnerability. The following patched versions are available:

• Roundcube Release 1.5.14 - For the 1.5.x branch
• Roundcube Release 1.6.14 - For the 1.6.x branch
• Roundcube Release 1.7-rc5 - For the upcoming 1.7 release

For additional details, see the Roundcube Security Updates Announcement. The security fixes are tracked in multiple commits including e052328e3dc75f13adc2e314eaa4096ac21084ad, fd0e98178db5c73eaa93d005b561874923f9b0f0, and fde14d01adc9f37893cd82b635883e516ed453f8.

Workarounds

• Configure Roundcube to display emails in plain text mode only, disabling HTML rendering entirely
• Implement Content Security Policy (CSP) headers to restrict external resource loading from the webmail interface
• Deploy a reverse proxy or WAF to strip or neutralize background attributes from incoming email HTML
• Consider using an email security gateway to sanitize HTML content before delivery to Roundcube

# Example: Configure Roundcube to prefer plain text display
# Edit config/config.inc.php
$config['prefer_html'] = false;
$config['show_images'] = 0;