CVE-2026-35545
SVG-Based Remote Image Blocking Bypass in Roundcube Webmail
Publication date: 2026-04-03
Last updated on: 2026-04-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| roundcube | webmail | to 1.5.15 (exc) |
| roundcube | webmail | From 1.6.0 (inc) to 1.6.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-669 | The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Roundcube Webmail before versions 1.5.15 and 1.6.15 involves a bypass of the remote image blocking feature via SVG content in email messages. Specifically, attackers could exploit the SVG <animate> element's FUNCIRI attribute with attributeName values such as fill, filter, or stroke to load remote images despite protections.
This bypass occurs because the sanitization logic did not properly check these SVG attributes for unsafe remote URL references, allowing remote image loading through SVG animations. The issue could lead to information disclosure or access-control bypass by loading external resources without user consent.
How can this vulnerability impact me? :
This vulnerability can impact users by allowing attackers to bypass remote image blocking in emails, potentially leading to information disclosure or unauthorized access control bypass.
By loading remote images through manipulated SVG animations, attackers could track user interactions, leak sensitive information, or execute further attacks that rely on loading external content without detection.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for SVG animate elements in e-mail messages that use the FUNCIRI attribute with fill, filter, or stroke properties to load remote images. The vulnerability was addressed by enhancing sanitization logic to block SVG animate elements with these attributes containing remote URLs.
Roundcube Webmail 1.7 RC6 introduced a system health checker CLI script to assist administrators in monitoring system status, which may help in detecting issues related to this vulnerability.
While no specific commands are provided in the resources, administrators can inspect incoming emails for SVG content with animate elements using attributes like fill, filter, or stroke containing URL references. For example, searching mail logs or message sources for patterns like `<animate attributeName="fill" values="url(` could help identify exploit attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update Roundcube Webmail to a fixed version that addresses this vulnerability. The security fix is included in versions 1.5.15, 1.6.15, and 1.7 RC6.
- Upgrade your Roundcube installation to version 1.5.15 or later if you are on the 1.5 branch.
- Upgrade to version 1.6.15 or later if you are on the 1.6 branch.
- Consider testing and deploying version 1.7 RC6, which also includes the fix and additional improvements.
Before upgrading, back up your data and configurations. Use the provided migration scripts such as `installto.sh` or `update.sh` to apply the update safely.
The fix enhances sanitization by blocking SVG animate elements with FUNCIRI attributes that reference remote URLs in fill, filter, stroke, and related attributes, preventing remote image loading bypasses.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Roundcube Webmail allows remote image loading via SVG animate elements, potentially leading to information disclosure or access-control bypass.
Such information disclosure risks could impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access or leakage.
If exploited, this vulnerability might expose user data or email content to unauthorized parties, thereby violating confidentiality requirements mandated by these standards.
Therefore, organizations using vulnerable versions of Roundcube Webmail should update promptly to mitigate risks that could lead to non-compliance with these regulations.