CVE-2026-35542: Roundcube Remote Image Blocking Bypass via BODY Background Attribute
Summary
CVE-2026-35542: Roundcube: Bypass of remote image blocking via crafted BODY background attribute. Affects roundcube/roundcubemail versions >= 1.7-beta, < 1.7-rc5. Fixed in 1.7-rc5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Roundcube is a widely used open-source webmail client that allows users to manage their emails through a web interface. It offers features such as email filtering, contact management, and support for multiple email protocols. However, vulnerabilities can arise in its handling of HTML content in emails, particularly in how it processes remote images.
Vulnerability Detail
An issue was discovered in Roundcube Webmail versions prior to 1.5.14 and 1.6.14, where the remote image blocking feature can be bypassed through a crafted background attribute in the BODY element of an email message. This vulnerability could lead to information disclosure or access-control bypass, allowing unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.7-rc5
This is the first release that contains the fix.
composer require roundcube/roundcubemail:1.7-rc5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the rendering of background images in emails by modifying your email client settings or applying custom CSS styles to prevent the BODY background attribute from being processed.
Conclusion
CVE-2026-35542 is a significant vulnerability in Roundcube that can lead to information disclosure through a bypass of remote image blocking. It is crucial for users to update to the latest patched versions to mitigate this risk.
See every vulnerability recorded for roundcube/roundcubemail →
FAQ
CVE-2026-35542 is a vulnerability in Roundcube that allows bypassing remote image blocking through a crafted BODY background attribute in emails.
Versions of Roundcube prior to 1.5.14 and 1.6.14 are affected by this vulnerability.
If not fixed, this vulnerability may lead to unauthorized access to sensitive information through remote images.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using the composer.lock file, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundcube/roundcubemail.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
