CVE-2026-35544: Roundcube Webmail XSS Vulnerability

CVE-2026-35544 Overview

CVE-2026-35544 is a CSS sanitization bypass vulnerability discovered in Roundcube Webmail. The flaw exists in the HTML email message processing component, where insufficient Cascading Style Sheets (CSS) sanitization allows attackers to bypass fixed-position mitigations by using the CSS !important declaration. This vulnerability enables malicious actors to craft specially formatted HTML emails that can manipulate the visual presentation of content within the webmail interface.

Critical Impact

Attackers can bypass security controls designed to prevent fixed-position CSS abuse in HTML emails, potentially enabling UI manipulation, phishing overlays, or clickjacking-style attacks against Roundcube Webmail users.

Affected Products

• Roundcube Webmail versions prior to 1.5.14
• Roundcube Webmail versions prior to 1.6.14
• Roundcube Webmail version 1.7-rc4 and earlier

Discovery Timeline

• 2026-03-18 - Roundcube releases security updates 1.7-rc5, 1.6.14, and 1.5.14
• 2026-04-03 - CVE-2026-35544 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35544

Vulnerability Analysis

The vulnerability resides in Roundcube Webmail's CSS sanitization logic within the rcube_utils.php file. Roundcube implements security controls to convert potentially dangerous position: fixed CSS declarations to position: absolute to prevent UI manipulation attacks. However, the original implementation used strcasecmp() for exact string matching, which failed to detect when the !important declaration was appended to the value (e.g., fixed !important).

This insufficient input validation classifies as CWE-669 (Incorrect Resource Transfer Between Spheres), where untrusted CSS content passes through the sanitization layer without proper neutralization.

Root Cause

The root cause lies in the overly strict string comparison logic used for detecting the fixed position value. The vulnerable code used strcasecmp($value, 'fixed') === 0, which only matches when the value is exactly "fixed" (case-insensitive). Attackers could bypass this check by appending !important to the CSS value, resulting in strings like fixed !important that would not match the exact comparison but would still be interpreted as position: fixed by browsers due to CSS parsing rules.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a maliciously crafted HTML email to a Roundcube Webmail user. When the victim views the email, the embedded CSS containing position: fixed !important bypasses the sanitization filter, allowing elements to be positioned at fixed coordinates on the screen. This can be exploited to overlay fake UI elements, obscure legitimate content, or create deceptive interfaces for phishing attacks.

// Vulnerable code (before patch)
} elseif ($property == 'position' && strcasecmp($value, 'fixed') === 0) {
    // Convert position:fixed to position:absolute (#5264)
    $value = 'absolute';
}

// Patched code (after fix)
} elseif ($property == 'position' && stripos($value, 'fixed') !== false) {
    // Convert position:fixed to position:absolute (#5264)
    $value = 'absolute';
}

Source: GitHub Commit

Detection Methods for CVE-2026-35544

Indicators of Compromise

• HTML emails containing CSS declarations with position: fixed !important or similar patterns
• Email messages with unusually complex inline styles targeting position properties
• User reports of unexpected visual overlays or UI elements when viewing emails
• Web application logs showing emails with obfuscated or encoded CSS content

Detection Strategies

• Implement email content inspection rules to detect position:\s*fixed\s*!important patterns in incoming messages
• Monitor web application firewall (WAF) logs for HTML emails containing suspicious CSS declarations
• Deploy content security policy (CSP) headers to restrict positioning behaviors where possible
• Review Roundcube access logs for patterns indicating exploitation attempts

Monitoring Recommendations

• Enable verbose logging for Roundcube's HTML sanitization component to capture bypassed content
• Configure alerting for emails containing multiple !important CSS declarations targeting layout properties
• Implement anomaly detection for emails with excessive inline CSS or style blocks
• Monitor for user complaints about phishing-like behavior within the webmail interface

How to Mitigate CVE-2026-35544

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.5.14, 1.6.14, or 1.7-rc5 immediately
• Review email quarantine logs for potentially malicious messages received before patching
• Notify users about the vulnerability and advise caution when viewing suspicious emails
• Consider temporarily disabling HTML email rendering if immediate patching is not possible

Patch Information

Roundcube has released security patches addressing this vulnerability across all supported branches. The fix changes the CSS position value detection from exact string matching (strcasecmp) to substring detection (stripos), ensuring that any CSS value containing "fixed" will be properly sanitized regardless of additional modifiers like !important.

Official patches are available at:

• Roundcube Webmail 1.5.14
• Roundcube Webmail 1.6.14
• Roundcube Webmail 1.7-rc5

For additional details, see the Roundcube Security Advisory.

Workarounds

• Configure email gateway to strip or sanitize CSS containing position properties with !important declarations
• Disable HTML email rendering in Roundcube by setting $config['prefer_html'] = false; in the configuration
• Implement additional CSS filtering at the reverse proxy or WAF level to block position: fixed patterns
• Educate users to use plain text view for suspicious emails until patches are applied

# Configuration example - Disable HTML email rendering as temporary mitigation
# Edit config/config.inc.php
echo "\$config['prefer_html'] = false;" >> /var/www/roundcube/config/config.inc.php
echo "\$config['show_images'] = 0;" >> /var/www/roundcube/config/config.inc.php

# Restart web server to apply changes
systemctl restart apache2
# or
systemctl restart nginx