CVE-2026-74998

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3

Description Responses from the CSS (Cascading Style Sheets) proxy were not validated. This lack of validation may lead to information disclosure or XSS (cross-site scripting), a technique where malicious scripts are injected into trusted websites, via MIME sniffing. MIME sniffing is a process where a browser attempts to determine the file type of a resource by inspecting its content rather than relying on the declared MIME type.

Recommendations Update Roundcube Webmail to version 1.6.18 or later. Update Roundcube Webmail to version 1.7.3 or later.