EUVD-2026-60167
GHSA-4649-47v5-9mqg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Victim must actively open the email to trigger exploitation (UI:R); scope changes as the sanitizer boundary is breached to initiate external network requests, with no integrity or availability impact confirmed.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.
AnalysisAI
Remote image blocking bypass in Roundcube Webmail (all versions before 1.6.18 and 1.7.x before 1.7.3) allows network-based attackers to defeat content security filters through crafted SVG animate elements, with potential for user metadata disclosure and privilege escalation. The sanitizer's failure to validate the SVG animate by attribute permits malicious email content to trigger outbound resource loads that the webmail's blocking controls were designed to prevent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must open or preview a malicious email within a Roundcube Webmail instance running any version prior to 1.6.18 or 1.7.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.8 score with Scope:Changed (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) reflects that the attack boundary extends beyond the webmail application itself, but the confidentiality impact is rated Limited - primarily user IP address, email-open event, and client fingerprint exposure rather than session or credential compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker authors a malicious HTML email embedding an SVG element whose `animate by` attribute references an attacker-controlled URL, then delivers it to any mailbox served by a vulnerable Roundcube instance. When the victim opens or previews the message, Roundcube's sanitizer passes the attribute through unchecked, causing the webmail client to silently fetch the external resource and disclosing the victim's IP address, read timestamp, and browser fingerprint to the attacker. … |
| Remediation | The primary fix is to upgrade to Roundcube Webmail 1.6.18 (https://github.com/roundcube/roundcubemail/releases/tag/1.6.18) or 1.7.3 (https://github.com/roundcube/roundcubemail/releases/tag/1.7.3) as directed by the vendor advisory at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3; the vendor explicitly marks both as stable and recommends all production installations upgrade with a prior data backup. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
An issue was discovered in Roundcube Webmail before 1.4.4. Rated medium severity (CVSS 6.5), this vulnerability is remot
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary w
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today