CVE-2026-35542
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In Roundcube Webmail before versions 1.5.14 and 1.6.14, the remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an email message. This may lead to information disclosure or access-control bypass.
Risk Assessment
An attacker can send an email with a crafted background attribute, bypassing remote image blocking and potentially disclosing sensitive data.
Recommendation
Immediately update Roundcube Webmail to version 1.5.14 or 1.6.14.
Original NVD description (English source)
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.