Roundcube Webmail EUVD-2026-60165

Exploitation requires the target Roundcube instance to have its CSS proxy active, which is standard behavior for HTML email rendering and not a non-default configuration. The attacker must be able to deliver an email to the target user containing a reference to an attacker-controlled CSS resource reachable by the Roundcube server, and the victim must open or preview that email. Exploitation is constrained by: the need for victim interaction to open the crafted email; the requirement that the Roundcube server can make outbound HTTP requests to the attacker's server (strict egress filtering reduces exposure); and the attacker having no required authenticated access to Roundcube itself. The attack is entirely initiated via the email delivery path.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a network-exploitable, low-complexity path with no privilege requirement and Changed scope, consistent with XSS executing in a victim's browser session. However, the UI:N designation in the vendor-provided vector warrants scrutiny: realistic exploitation requires a victim to open or preview a crafted email containing the malicious CSS reference, implying at minimum passive user interaction. No EPSS score was provided in the source intelligence, and no CISA KEV listing is present, indicating exploitation has not been observed at scale. Despite the absence of a weaponized public exploit, Roundcube is common in resource-constrained self-hosted environments - even a mid-sized municipal IT team in inowroclaw running a self-hosted mail stack should treat this patch cycle as urgent, because the same release bundle resolves multiple additional critical vulnerabilities including an RCE in the markasjunk plugin, IMAP command injection, LDAP filter injection, and several SSRF bypass chains, making the aggregate patch priority substantially higher than this individual CVE's score alone suggests.

An attacker sends a crafted HTML email to a Roundcube user, embedding a link to an attacker-controlled external CSS resource. When the victim opens or previews the email, Roundcube's CSS proxy fetches the resource; the attacker's server returns payload content without a valid Content-Type header, causing the victim's browser to MIME-sniff it as executable script running in the Roundcube webmail origin, potentially stealing session tokens or reading email content. No public proof-of-concept exploit has been identified at the time of analysis.