CVE-2026-35545CWE-669

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15

Medium · published April 3, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-669 · Incorrect Resource Transfer Between Spheres
Published
2026-04-03T04:02Z
EPSS history
Timeline
  • 03 APR 04:02Z
    An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15
    cvelistv5