CVE-2026-35545: Roundcube Webmail Remote Image Blocking Bypass via SVG Content
Summary
CVE-2026-35545: Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message. Affects roundcube/roundcubemail versions >= 1.7-beta, < 1.7-rc5. Fixed in 1.7-rc5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundcube Webmail is an open-source webmail solution that provides a user-friendly interface for managing emails. It supports various features such as email filtering, address book management, and remote image blocking to enhance user privacy and security. However, certain vulnerabilities can compromise these features, leading to potential information disclosure.
Vulnerability Detail
An issue was discovered in Roundcube Webmail versions prior to 1.5.15 and 1.6.15, where the remote image blocking feature can be bypassed through SVG content embedded in email messages. This vulnerability specifically involves the use of the animate element with attributes like fill, filter, or stroke, which may allow attackers to disclose sensitive information or bypass access controls.
How To Fix
Minimum fixed version
1.7-rc5
This is the first release that contains the fix.
composer require roundcube/roundcubemail:1.7-rc5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the rendering of SVG content in email messages by modifying the configuration settings in Roundcube. This can be done by adjusting the config/config.inc.php file to ensure that SVG images are not displayed.
Conclusion
The CVE-2026-35545 vulnerability in Roundcube Webmail poses a risk by allowing the bypass of remote image blocking through SVG content. Users are advised to update to the latest versions to mitigate this risk and ensure the security of their email communications.
See every vulnerability recorded for roundcube/roundcubemail →
FAQ
CVE-2026-35545 is a vulnerability in Roundcube Webmail that allows attackers to bypass the remote image blocking feature using SVG content in emails.
Versions of Roundcube Webmail prior to 1.5.15 and 1.6.15 are affected by this vulnerability.
The vulnerability may lead to information disclosure or access-control bypass, potentially exposing sensitive user data.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundcube/roundcubemail.
