🔺Severity: Medium
👽 Reporter: nullcathedral
⭐️ Reputation: 150
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-07
⏰ Disclosed: 2026-04-20 12:03:51
📝 Summary: A vulnerability was discovered in Roundcube's HTML sanitizer that enabled CSS injection when the
allow remote option was set to false. The sanitizer failed to quote the value of the background attribute from the email's <body> element, allowing a crafted data: URI to terminate the url() function and inject arbitrary CSS properties. This bypass allowed external resources to be loaded even when remote image blocking was enabled.📂 Report JSON File: 3590583
@hackeronereports