CVE-2026-26079 | Roundcube Webmail up to 1.5.12/1.6.12 Cascading Style Sheet inclusion of functionality from untrusted control sphere

A vulnerability identified as problematic has been detected in Roundcube Webmail up to 1.5.12/1.6.12. Affected by this issue is some unknown functionality of the component Cascading Style Sheet Handler. This manipulation causes inclusion of functionality from untrusted control sphere.

This vulnerability is registered as CVE-2026-26079. Remote exploitation of the attack is possible. No exploit is available.

You should upgrade the affected component.