EUVD-2026-18593
GHSA-w846-74jr-76cv
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a moderate vulnerability with a score of 5.3, reflecting network-accessible, low-complexity attack requiring no privileges or user interaction, with limited integrity impact. However, the actual real-world risk is elevated by several factors: first, the vulnerability affects webmail systems that handle sensitive email communications across diverse user bases; second, the attack vector is passive (email-based), making detection difficult; third, the access-control bypass nature suggests attackers can defeat a core security feature without triggering alerts. The integrity impact (I:L) is conservative-the ability to load external resources can enable tracking, credential harvesting, or phishing validation. The lack of confidentiality impact in the vector may understate information disclosure risk, as revealed IP addresses or user behavior patterns constitute data leakage. No KEV status or public POC availability data is provided, suggesting this is not yet confirmed actively exploited; however, the straightforward nature of SVG attribute injection and the widespread deployment of Roundcube mean weaponization is feasible if details become public. |
| Exploit ScenarioDerived | An attacker crafts a malicious email containing an embedded SVG element with an animate tag using attributeName='fill' or attributeName='filter' to reference an external image URL. When a victim using vulnerable Roundcube opens this email, the webmail client's image blocking feature fails to sanitize the SVG payload, allowing the external resource to be loaded. This reveals the victim's IP address and browser/client fingerprint to the attacker's server, enabling tracking or serving malicious content. No public POC availability is indicated at the time of this analysis; exploitation requires only crafting a valid SVG-based email, well within attacker capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Roundcube Webmail before versions 1.5.15 and 1.6.15 fails to properly sanitize SVG content in email messages, allowing the remote image blocking feature to be bypassed via SVG animate elements with malicious attributeName values. This vulnerability enables unauthenticated attackers to bypass access controls and potentially disclose information through image loading, affecting all Roundcube installations using vulnerable versions.
RemediationAI
Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.15 or later (for 1.5.x users) or version 1.6.15 or later (for 1.6.x users). The patches are available via GitHub releases at https://github.com/roundcube/roundcubemail/releases/tag/1.6.15 and https://github.com/roundcube/roundcubemail/releases/tag/1.5.15, with corresponding commits 9d18d524f3cc211003fc99e2e54eed09a2f3da88 and fe1320b199d3a2f58351bb699c9ed4316e73221b respectively. Users on 1.7-rc6 or later are also covered. No workarounds are documented; patching is the primary remediation path. Organizations should prioritize this update as webmail is often a primary attack surface for credential theft and phishing campaigns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube's remote image blocking feature is designed to prevent external image references in emails from being loaded without user consent, protecting against tracking and information disclosure. The vulnerability exploits SVG (Scalable Vector Graphics) handling, specifically the SVG animate element with attributeName parameters targeting fill, filter, or stroke properties. This represents a CWE-669 (Incorrect Resource Validation) issue where the sanitization logic fails to account for SVG-based content delivery mechanisms that bypass the standard image-blocking rules. The affected product is identified via CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* across all vulnerable versions in the 1.5.x branch (before 1.5.15) and 1.6.x branch (before 1.6.15).
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Roundcube Webmail Multiple Vulnerabilities
View all 8Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB