CVE-2026-114722 | Roundcube Webmail up to 1.6.19/1.7.4 HTML message mod_css_styles HTML injection

October 22, 2026 Yanac

A vulnerability was found in Roundcube Webmail up to 1.6.19/1.7.4. It has been declared as problematic. This affects the function rcube_utils::mod_css_styles of the component HTML message Handler. The manipulation results in HTML injection.

This vulnerability is known as CVE-2026-114722. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More