What is the CVSS score of CVE-2026-35539?

CVE-2026-35539 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35539?

Yes, a patch is available for CVE-2026-35539. Update the affected software to the latest version immediately.

Webmail CVE-2026-35539

EUVD-2026-18581 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-03 mitre

GHSA-x4q5-8j5g-hpjc

XSS Webmail

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 04:30 euvd

EUVD-2026-18581

Analysis Generated

Apr 03, 2026 - 04:30 vuln.today

CVE Published

Apr 03, 2026 - 03:39 nvd

MEDIUM 6.1

DescriptionCVE.org

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.

AnalysisAI

Cross-site scripting (XSS) in Roundcube Webmail before versions 1.5.14 and 1.6.14 allows remote attackers to inject malicious scripts via insufficient HTML sanitization in text/html attachment preview mode. An authenticated user must preview a malicious text/html attachment to trigger the vulnerability, enabling attackers to steal session cookies, redirect users, or perform actions on behalf of the victim. No public exploit code or active exploitation has been confirmed; EPSS score of 6.1 reflects moderate real-world risk given the user interaction requirement.

Technical ContextAI

Roundcube Webmail's attachment preview functionality fails to properly sanitize HTML content in text/html MIME type attachments before rendering them in the browser. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected/stored XSS vulnerability pattern. When a user previews an HTML attachment, the application does not strip or escape dangerous HTML tags and JavaScript event handlers, allowing arbitrary script execution within the context of the webmail application. This affects all Roundcube Webmail versions up to 1.5.13 (in the 1.5.x branch) and up to 1.6.13 (in the 1.6.x branch), as identified by CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.14 or later (1.5.x branch) or 1.6.14 or later (1.6.x branch). Users on the 1.7 development track should update to 1.7-rc5 or any subsequent release. Patched releases are available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 and https://github.com/roundcube/roundcubemail/releases/tag/1.5.14. The underlying fixes (commits 10a6d1fa and d742954c) improve HTML sanitization in the attachment preview handler. Until patching is possible, users should avoid previewing HTML attachments from untrusted sources and consider disabling HTML preview in attachment settings if available.