CVE-2026-35545
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Roundcube Webmail before versions 1.5.15 and 1.6.15, the remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
Risk Assessment
An attacker can send a crafted email that bypasses remote image blocking, potentially disclosing sensitive information or enabling further attacks.
Recommendation
Update Roundcube Webmail to version 1.5.15, 1.6.15, or later.
Original NVD description (English source)
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.