Skip to main content

Roundcube Webmail CVE-2026-75003

| EUVDEUVD-2026-60169 MEDIUM
Incorrect Resource Transfer Between Spheres (CWE-669)
2026-08-17 mitre GHSA-mh9g-rh94-w7mh
Information Disclosure Privilege Escalation Webmail Suse
5.8
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
5.8 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
vuln.today AI
4.7 MEDIUM

Email rendering requires the recipient to open or preview the message (UI:R); scope changes because the attacker's external server receives victim data; confidentiality impact is limited to IP and metadata leakage.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch available
Aug 17, 2026 - 14:15 EUVD
Source Code Evidence Fetched
Aug 17, 2026 - 13:40 vuln.today
Analysis Generated
Aug 17, 2026 - 13:40 vuln.today

DescriptionCVE.org

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.

AnalysisAI

SVG FuncIRI parsing in Roundcube Webmail allows remote unauthenticated attackers to bypass the webmail's remote content blocking mechanism by embedding a crafted SVG containing an unclosed url() in a FuncIRI attribute within an email. Affected are all 1.6.x versions before 1.6.18 and all 1.7.x versions before 1.7.3. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send email with malformed SVG FuncIRI url()
Delivery
Recipient opens email in Roundcube
Exploit
Bypass remote content blocking filter
Execution
Browser fetches attacker-controlled external URL
Impact
Attacker server captures victim IP and metadata
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must be a Roundcube Webmail installation running a version prior to 1.6.18 (stable) or 1.7.3 (development). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 3.1 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) rates this as medium severity with changed scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted HTML email to a Roundcube user containing an SVG element with an unclosed url() expression in a FuncIRI attribute such as fill or filter. When the recipient views the email in Roundcube, the malformed url() bypasses the remote content blocking filter, causing the browser to make an outbound HTTP request to an attacker-controlled server. …
Remediation Upgrade to Roundcube Webmail 1.6.18 (stable branch) or 1.7.3 (development branch), both released August 9, 2026 and available via the vendor advisory at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 and GitHub releases at https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.3. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Webmail

View all
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2016-9920 HIGH POC
7.5 Dec 08

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
CVE-2020-12641 CRITICAL POC
9.8 May 04

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
CVE-2020-12640 CRITICAL POC
9.8 May 04

Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
CVE-2015-2180 HIGH POC
8.8 Jan 30

The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
CVE-2024-42009 CRITICAL POC
9.3 Aug 05

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
CVE-2015-2181 HIGH POC
8.8 Jan 30

Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
CVE-2017-8114 HIGH POC
8.8 Apr 29

Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
CVE-2018-1000071 HIGH POC
7.5 Mar 13

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
CVE-2020-12626 MEDIUM POC
6.5 May 04

An issue was discovered in Roundcube Webmail before 1.4.4. Rated medium severity (CVSS 6.5), this vulnerability is remot
CVE-2016-4552 MEDIUM POC
6.1 Dec 20

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary w
CVE-2015-8793 MEDIUM POC
6.1 Jan 29

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2

Same weakness CWE-669 – Incorrect Resource Transfer Between Spheres

View all
CVE-2026-31431 HIGH POC
7.8
CVE-2020-1048 HIGH POC
7.8
CVE-2020-5800 CRITICAL POC
9.8
CVE-2020-15892 CRITICAL POC
9.8
CVE-2026-25253 HIGH POC
8.8
CVE-2020-25917 HIGH POC
8.8
CVE-2019-13266 HIGH POC
8.8
CVE-2019-13263 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-75003 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy