CVE-2026-35543 in Webmail

Sumário (Inglês)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Responsável

MITRE

Reservar

03/04/2026

Divulgação

03/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
355057	Roundcube Webmail SVG Content Divulgação de Informação	669	Não definido	Correção oficial	CVE-2026-35543

Fontes

• MITRE
• NVD
• CVE Details