Resource Injection (CWE-99)CVSS 5.4€0
position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.
nullcathedral
Disclosed on HackerOne · April 20, 2026
Publicly disclosed report · by nullcathedral
View original on HackerOneWhen sanitizing CSS, Roundcube's sanitize_css_block() in rcube_utils.php converts position: fixed to position: absolute to prevent overlay attacks (L555-557).
However, the check uses strcasecmp($value, 'fixed') === 0, which requires the entire trimmed value to be exactly "fixed". The value "fixed !important" fails this comparison. The value then flows through the generic token-based validation path, where explode_css_property_block() splits it into tokens ['fixed', '!important'] that both individually pass the allowlist, reassembling as position: fixed !important in the output.
Steps To Reproduce
Step 1: Send an HTML email with the following body:
<!DOCTYPE html>