EUVD-2026-31725
GHSA-xx87-33v7-6x23
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
AnalysisAI
Remote image blocking in Roundcube Webmail 1.6.x and 1.7.x can be silently bypassed by embedding a crafted CSS var() expression in an HTML email, causing the victim's browser to fetch attacker-controlled external resources despite the privacy control being active. This leads to information disclosure - including IP address leakage and email-open tracking - and potential access-control bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target deployment must be running Roundcube Webmail 1.6.0-1.6.15 or 1.7.0 with HTML email rendering enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a network-accessible, low-complexity flaw requiring no attacker authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a specially crafted HTML email to a Roundcube Webmail user, where the message body contains a CSS style block or inline style using a var() reference that resolves to an attacker-controlled image URL. When the victim views the email in their Roundcube session with HTML rendering enabled, the browser processes the CSS var() at render time - after Roundcube's sanitizer has already passed the content - and silently fetches the external resource, delivering the victim's IP address, browser fingerprint, and precise read timestamp to the attacker's server. … |
| Remediation | Upgrade to Roundcube Webmail 1.6.16 or 1.7.1, released 2026-05-24, per the vendor advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today