Protection mechanism failure in Roundcube Webmail - #VU156141
Published: October 19, 2026
Vulnerability identifier: #VU156141
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass remote content blocking and potentially disclose information through external content requests.
The vulnerability exists due to incomplete filtering of SVG SMIL attributes in remote content blocking when rendering content that uses the by attribute. A remote attacker can supply crafted SVG content using this attribute to trigger external content loading despite the blocking policy.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5