CVE-2026-35545 - An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15

Back Back to CVE browser

HIGH

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15

Published Apr 3, 2026

8.2

HIGH

CVSS 3.1

EPSS 0.55%

Description

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

Affected products

Vendor Roundcube Product Webmail Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.5.15
- Version
  1.6.0
  Status
  affected
  Constraints
  <1.6.15

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Roundcube

Webmail

unaffected

Version	Status	Constraints
0	affected	<1.5.15
1.6.0	affected	<1.6.15

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-669

References (10)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18593		Advisory
https://github.com/advisories/GHSA-w846-74jr-76cv		Advisory
https://github.com/roundcube/roundcubemail/commit/7ad62de184368bf42c0f522d1aacc030f5ddcc46		Patch
https://github.com/roundcube/roundcubemail/commit/9d18d524f3cc211003fc99e2e54eed09a2f3da88		Patch
https://github.com/roundcube/roundcubemail/commit/fe1320b199d3a2f58351bb699c9ed4316e73221b		Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.5.15		Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.15		Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc6		Release Notes
https://nvd.nist.gov/vuln/detail/CVE-2026-35545
https://roundcube.net/news/2026/03/29/security-updates-1.7-rc6-1.6.15-1.5.15		Vendor Advisory