EUVD-2026-60169
GHSA-mh9g-rh94-w7mh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft SVG with unclosed url() FuncIRI
-
DeliverySend HTML email to victim
-
ExploitVictim opens message in Roundcube
-
ExecutionSanitizer fails to strip remote reference
-
PersistBrowser fetches attacker URL
-
ImpactLeak victim IP, client fingerprint, open telemetry
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Exploitation Conditions | Requires the victim to open/view an attacker-supplied HTML email in a vulnerable Roundcube web interface (1.6.0-1.6.17 or 1.7.0-1.7.2); the malicious payload must be an SVG image containing a FuncIRI attribute with an unclosed url() token so the remote-content sanitizer fails to recognize it. Exploitation is limited by the need for user interaction (the recipient must render the message) and by the fact that the practical outcome is loading of remote content - i.e. tracking/beaconing and client fingerprinting - rather than direct code execution; the description's mention of 'privilege escalation' is not substantiated with prerequisites in the available data. |
| Impact | Signals conflict sharply with the headline score. The input CVSS 3.1 vector is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that is inconsistent with the described impact: bypassing remote-image blocking is fundamentally a privacy/tracking leak that requires the victim to open the message (UI should be Required), and it does not by itself grant integrity or availability impact - so C:H/I:H/A:H and UI:N appear overstated. Corroborating this, CISA SSVC lists Exploitation: none and EPSS is only 0.31% (23rd percentile), and there is no KEV listing or POC. Automatable: yes and Technical Impact: total in SSVC reflect the raw CVSS input rather than the modest real-world effect. Realistic priority is low-to-moderate: it is a genuine privacy/anti-tracking regression worth patching in the normal cycle, not an emergency RCE. Verify the true impact ceiling with the vendor - the 'privilege escalation' language in the description is unexplained and not substantiated by any technical detail in the sources. |
| Exploit ScenarioDerived | An attacker emails a target Roundcube user an HTML message containing an SVG whose FuncIRI attribute uses an unclosed url() pointing at attacker-controlled infrastructure. When the victim opens the message, the sanitizer fails to strip the reference and the browser silently fetches the attacker URL, confirming the mailbox is live and leaking the victim's IP, user-agent and open timing. No public exploit is identified at time of analysis, but the technique is simple and automatable per SSVC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 10, 2026
Remote content blocking evasion in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 lets a crafted SVG image with an unclosed url() in a FuncIRI attribute slip past the remote-image blocker, so external resources load when a victim views a malicious email. This exposes the recipient's IP, mail-client fingerprint, and email-open telemetry to the sender, and per the advisory may aid further information disclosure or privilege escalation. It has a vendor patch and no public exploit identified at time of analysis; EPSS is low (0.31%) and CISA SSVC rates exploitation as none.
Earlier versions of this analysis (1)
SVG FuncIRI parsing in Roundcube Webmail allows remote unauthenticated attackers to bypass the webmail's remote content blocking mechanism by embedding a crafted SVG containing an unclosed url() in a FuncIRI attribute within an email. Affected are all 1.6.x versions before 1.6.18 and all 1.7.x versions before 1.7.3. Successful exploitation causes the victim's browser to silently fetch an attacker-controlled external resource, disclosing the user's IP address and browser metadata, and the vendor tags this as potentially enabling privilege escalation; no public exploit has been identified at time of analysis, and vendor-released patches (1.6.18 and 1.7.3) are available as of August 9, 2026.
RemediationAI
Vendor-released patch: upgrade to Roundcube Webmail 1.6.18 (1.6 branch) or 1.7.3 (1.7 branch), which add validation that recognizes the unclosed url() FuncIRI as remote content (commits 1cebea03474305d9f75a9a33d30880d290b5591b and 440277c32e6d84f3d116153af1cc8454361a8a56); back up data before updating as the vendor advises. Because these releases also fix SSRF, LDAP filter injection, Sieve injection, IMAP command injection and a markasjunk RCE, treat the upgrade as high value even though this specific issue is low severity. As an interim compensating control until patched, you can restrict or disable HTML mail rendering / force plain-text display for untrusted senders (trade-off: degrades legitimate HTML mail usability), and ensure the outbound CSS/image proxy is enabled so remote fetches are mediated rather than made directly from the client browser. Advisory: https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube is a widely deployed PHP/IMAP browser-based webmail client (cpe:2.3:a:roundcube:webmail). To protect privacy, it blocks remote content in HTML mail until the user opts in. The flaw is CWE-669 (Incorrect Resource Transfer Between Spheres): the HTML/SVG sanitizer parses url() references (FuncIRI values used by SVG paint/filter attributes) to decide what is a remote resource, but an unclosed url( token confuses that parser so the reference is not recognized and stripped, allowing the browser to fetch the attacker-controlled URL anyway. The same 1.6.18/1.7.3 release hardened several adjacent parsing/sanitization issues (SSRF filter bypasses, SVG animate 'by' sanitization bypass, stored XSS), indicating a broader audit of the content-filtering pipeline by external reporters (this issue by Milan Hoppe).
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker emails a payload but the victim must open it (UI:R); the effect is loading remote content leaking client/privacy data (C:L), with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.
Executive ViewAI
Roundcube Webmail versions before 1.6.18 and 1.7.3 contain a vulnerability that bypasses remote image-blocking controls in email. Attackers can embed tracking resources in malicious emails to collect the recipient's IP address, mail client fingerprint, and email-open telemetry, enabling precise targeting for subsequent attacks. This privacy breach affects all users of vulnerable instances and could compromise organizational reputation if discovered.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB