What is the CVSS score of CVE-2026-35545?

CVE-2026-35545 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35545?

Yes, a patch is available for CVE-2026-35545. Update the affected software to the latest version immediately.

Webmail CVE-2026-35545

EUVD-2026-18593 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-04-03 mitre

GHSA-w846-74jr-76cv

Information Disclosure Webmail

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jul 24, 2026 - 21:22 NVD

5.3 (MEDIUM) 8.2 (HIGH)

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 04:30 euvd

EUVD-2026-18593

Analysis Generated

Apr 03, 2026 - 04:30 vuln.today

CVE Published

Apr 03, 2026 - 04:02 nvd

MEDIUM 5.3

DescriptionNVD

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

AnalysisAI

Roundcube Webmail before versions 1.5.15 and 1.6.15 fails to properly sanitize SVG content in email messages, allowing the remote image blocking feature to be bypassed via SVG animate elements with malicious attributeName values. This vulnerability enables unauthenticated attackers to bypass access controls and potentially disclose information through image loading, affecting all Roundcube installations using vulnerable versions.

Technical ContextAI

Roundcube's remote image blocking feature is designed to prevent external image references in emails from being loaded without user consent, protecting against tracking and information disclosure. The vulnerability exploits SVG (Scalable Vector Graphics) handling, specifically the SVG animate element with attributeName parameters targeting fill, filter, or stroke properties. This represents a CWE-669 (Incorrect Resource Validation) issue where the sanitization logic fails to account for SVG-based content delivery mechanisms that bypass the standard image-blocking rules. The affected product is identified via CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* across all vulnerable versions in the 1.5.x branch (before 1.5.15) and 1.6.x branch (before 1.6.15).

RemediationAI

Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.15 or later (for 1.5.x users) or version 1.6.15 or later (for 1.6.x users). The patches are available via GitHub releases at https://github.com/roundcube/roundcubemail/releases/tag/1.6.15 and https://github.com/roundcube/roundcubemail/releases/tag/1.5.15, with corresponding commits 9d18d524f3cc211003fc99e2e54eed09a2f3da88 and fe1320b199d3a2f58351bb699c9ed4316e73221b respectively. Users on 1.7-rc6 or later are also covered. No workarounds are documented; patching is the primary remediation path. Organizations should prioritize this update as webmail is often a primary attack surface for credential theft and phishing campaigns.