CVE-2021-26925: Fedoraproject Fedora

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only
• Roundcube Webmail: before 1.4.11 (fixed in 1.4.11)

Published 2021-02-09. Last modified 2026-06-17.