Email Information Disclosure Vulnerability in Roundcube Webmail by Roundcube
CVE-2026-35545

5.3MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
3 April 2026

What is CVE-2026-35545?

A flaw in Roundcube Webmail versions prior to 1.5.15 and 1.6.15 allows attackers to bypass the remote image blocking feature. By exploiting this vulnerability with SVG content in email messages that include specific animate element attributes (fill/filter/stroke), attackers may gain unauthorized access to sensitive information or improperly manipulate access controls. It is essential for users to update their Roundcube installations to mitigate the risks associated with this vulnerability.

Affected Version(s)

Webmail 0 < 1.5.15

Webmail 1.6.0 < 1.6.15

References

https://roundcube.net/news/2026/03/29/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/7ad62de...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.