EUVD-2026-18587
GHSA-5hf6-crg4-fg59
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Impact | This vulnerability presents moderate real-world risk aligned with its CVSS 5.3 score. The attack vector is network-based and requires no authentication (CVSS: AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by any email sender. However, the technical impact is limited to confidentiality (C:L/I:N/A:N) - information disclosure through confirmation of email delivery or user activity - without integrity or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at the time of analysis, suggesting this is primarily a privacy/operational security concern rather than a critical attack vector. Organizations using Roundcube should treat this as a standard maintenance security update, not an emergency patch, though deployment should not be delayed given the ease of exploitation and the prevalence of email tracking as an attack technique. |
| Exploit ScenarioDerived | An attacker sends a carefully crafted email message to a Roundcube user containing a BODY element with a malicious BACKGROUND attribute pointing to an attacker-controlled image server. When the user opens the email in Roundcube, despite the webmail client's remote image blocking feature being enabled, the BACKGROUND attribute bypass allows the browser to request the image from the attacker's server. This confirms to the attacker that the email address is valid and monitored by an active user, enabling operational reconnaissance for spear-phishing, account validation, or other social engineering attacks. No special privileges or user interaction beyond opening an email is required for the attack to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Roundcube Webmail before versions 1.5.14 and 1.6.14 allows unauthenticated remote attackers to bypass the remote image blocking security feature through a crafted background attribute in a BODY element of an email message, enabling information disclosure via tracking pixels or other image-based reconnaissance. The vulnerability affects all versions prior to 1.5.14 and 1.6.x versions before 1.6.14, with CVSS 5.3 (medium severity) reflecting the low confidentiality impact but lack of authentication requirements.
RemediationAI
Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.14 or later for the 1.5.x branch, version 1.6.14 or later for the 1.6.x branch, or 1.7-rc5 or later for the development branch. Administrators should apply patches immediately through their standard package management or by downloading the latest releases from https://github.com/roundcube/roundcubemail/releases/. No workarounds are documented; patch deployment is the only remediation. For organizations unable to immediately update, temporary mitigation could include disabling the remote image blocking feature and warning users about email tracking risks, though this is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube Webmail implements a remote image blocking feature as a privacy protection mechanism to prevent email senders from using image requests to track when messages are read or to identify valid email addresses. The vulnerability exploits improper input sanitization of HTML attributes within email messages, specifically the BACKGROUND attribute of the BODY element (CWE-669: Improper Neutralization of Input During Web Page Generation). When an attacker crafts an email with a malicious BACKGROUND attribute, the filtering logic fails to properly block the resulting image request, allowing the remote server to be contacted regardless of the user's privacy settings. This affects the web-based email client running on affected Roundcube installations (CPE: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*), which processes untrusted HTML from incoming email messages.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Roundcube Webmail Multiple Vulnerabilities
View all 8Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB