CVE Catalog
CVE-2026-35543
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.40%
33th percentile - higher than 33% of all known CVEs
Summary
In Roundcube Webmail before versions 1.5.14 and 1.6.14, the remote image blocking feature can be bypassed via SVG content with animate attributes in an email message. This may lead to information disclosure or access-control bypass.
Risk Assessment
An attacker can send a crafted email that bypasses remote image blocking, potentially disclosing sensitive data or gaining unauthorized access.
Recommendation
Immediately update Roundcube Webmail to version 1.5.14 or 1.6.14.
Original NVD description (English source)
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.