Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-17T13:16:54.270Z",
  "pubdate": "2026-08-17T13:16:54.270Z",
  "executiveSummary": "An information disclosure and cross-site scripting (XSS) vulnerability exists in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3.\nThe flaw resides in the CSS proxy component, which fails to adequately validate responses fetched through the proxy mechanism.\nAn unauthenticated or remote attacker can leverage MIME sniffing vectors to cause the browser to misinterpret stylesheet proxy output as executable content.\nSuccessful exploitation allows malicious script execution within the victim browser session, potentially leading to unauthorized data access, session hijacking, or information disclosure against authenticated users of the webmail interface.\nThe attack requires the victim to interact with or load malicious resources processed through the vulnerable CSS proxy, but no specific elevated privileges are required by the attacker to initiate the sequence.\nThe risk is mitigated by updating the affected Roundcube installations to the patched software versions.",
  "technicalDetails": "The vulnerability is caused by insufficient validation and sanitization of responses returned by the CSS proxy component within Roundcube Webmail.\nThe vulnerable component handles external or internal Cascading Style Sheet resources via a proxy mechanism designed to fetch and relay styling data to the client browser.\nBecause the application fails to enforce strict content-type verification or response sanitization, downstream web browsers are susceptible to MIME sniffing.\nMIME sniffing occurs when the browser attempts to automatically determine the correct content type of a resource based on its actual byte stream rather than relying strictly on the declared Content-Type HTTP response header.\nAn attacker can exploit this behavior by supplying a specially crafted payload disguised as a CSS resource that contains executable JavaScript or HTML markup.\nWhen the Roundcube CSS proxy relays this unvalidated response to the victim browser without enforcing robust security headers—such as a rigid Content-Type or X-Content-Type-Options: nosniff—the browser interprets the payload as executable script rather than a stylesheet.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious resource containing script payloads designed to bypass basic content filters via MIME confusion. Second, the attacker induces a targeted user to request or load this resource through the Roundcube CSS proxy. Third, the proxy fetches the resource and returns the unvalidated content to the victim's browser. Fourth, the browser performs MIME sniffing on the response, determines the content should be executed or rendered as script, and executes the payload within the security context of the victim's active Roundcube session.\nThe resulting impact includes cross-site scripting (XSS) and potential information disclosure, allowing the execution of arbitrary JavaScript in the user's browser, manipulation of the DOM, theft of session cookies, or unauthorized interaction with the underlying webmail API.\nAffected software includes Roundcube Webmail versions prior to 1.6.18 and versions in the 1.7.x branch prior to 1.7.3."
}