CVE-2026-35545: High severity Roundcube Webmail vulnerability
Published Apr 3, 2026
·Updated
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
Affected Software
3 affected componentsFixes available
composer/roundcube/roundcubemail>=1.7-beta<1.7-rc5
1.7-rc5
Roundcube Webmail<1.5.15
Roundcube Webmail>=1.6.0<1.6.15
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/roundcube/roundcubemailto a version that resolves this vulnerability.Fixed in 1.7-rc5
Event History
Apr 3, 2026
CVE Published
via MITRE·04:02 AM
Data Sourced
via MITRE·04:02 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 AM
Data Sourced
via GitHub·06:31 AM
DescriptionSeverityWeaknessAffected Software