CVE-2026-35543CWE-669

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14

Medium · published April 3, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-669 · Incorrect Resource Transfer Between Spheres
Published
2026-04-03T03:57Z
EPSS history
Timeline
  • 03 APR 03:57Z
    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
    cvelistv5