CVE-2026-35543: 
PHP vulnerability analysis and mitigation

CVE-2026-35543 is a remote image blocking bypass vulnerability in Roundcube Webmail that allows attackers to circumvent the application's image-blocking security control via SVG content containing animate, animatecolor, set, or animatetransform elements with specific attributes. It affects Roundcube Webmail versions before 1.5.14 and versions 1.6.0 through 1.6.13. The vulnerability was reported by researcher "nullcathedral" and patched on March 18, 2026, with public disclosure on April 3, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Roundcube News).

The root cause lies in incomplete input sanitization within Roundcube's HTML/SVG washing library (rcube_washtml.php), classified as CWE-669 (Incorrect Resource Transfer Between Spheres) and CWE-79 (Cross-site Scripting). The original code only blocked SVG animate-family tags (animate, animatecolor, set, animatetransform) when their attributeName was exactly href, using a case-sensitive string comparison — allowing bypasses via mixed-case values or other dangerous attribute names such as mask and cursor combined with url() values. The fix introduced a dedicated is_insecure_tag() function using case-insensitive regular expression matching and expanded the set of blocked attribute/value combinations (Roundcube Commit 82ab5ec, Roundcube Commit 3947134). No authentication or user interaction is required to trigger the vulnerability — an attacker simply sends a crafted email to a Roundcube user.

Successful exploitation can lead to information disclosure, as the bypass allows SVG animate elements to trigger outbound requests (e.g., loading remote resources via href, mask, or cursor URL references) when a victim views a malicious email, potentially leaking the victim's IP address, read status, or session-related data to an attacker-controlled server. Additionally, access-control mechanisms that rely on the image-blocking feature may be circumvented, enabling tracking pixels or similar covert channels. The confidentiality impact is rated Low with no integrity or availability impact (GitHub Advisory, Roundcube News).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.034%, reflecting a low probability of near-term exploitation. No threat actor attribution has been reported.

1. Craft a malicious email: Compose an HTML email containing an embedded SVG element with an animate-family tag (e.g., <animate>) whose attributeName is set to href (using mixed case such as Href or HREF to bypass the original case-sensitive check) and a values attribute pointing to an attacker-controlled URL (e.g., https://attacker.example.com/track).
2. Send the email: Deliver the crafted email to a target user's inbox on a vulnerable Roundcube instance (versions before 1.5.14 or 1.6.0–1.6.13).
3. Victim opens the email: When the victim views the message in Roundcube Webmail, the SVG animate element is rendered by the browser despite the remote image blocking feature being enabled.
4. Outbound request triggered: The browser initiates an HTTP request to the attacker-controlled URL embedded in the SVG animate attribute, disclosing the victim's IP address, approximate read time, and potentially session metadata.
5. Collect disclosed data: The attacker monitors their server logs to capture the incoming request, confirming the email was read and harvesting any disclosed information (Roundcube Commit 82ab5ec, GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the Roundcube server or client browsers to unexpected external hosts triggered immediately upon email viewing; requests with no corresponding user-initiated navigation.
• Email Content: Inbound emails containing SVG elements with <animate>, <animatecolor>, <set>, or <animatetransform> tags where attributeName references href, mask, or cursor combined with url() values pointing to external hosts.
• Logs: Roundcube mail rendering logs or web server access logs showing SVG content being processed from emails with animate-family tags; browser network logs showing unexpected external resource fetches when viewing specific emails.
• File System: No file system artifacts expected for this vulnerability, as exploitation is purely in-memory/network-based.

Roundcube has released patched versions addressing this vulnerability: 1.5.14 for the 1.5.x branch and 1.6.14 for the 1.6.x branch (both released March 18, 2026); the 1.7-rc5 pre-release also includes the fix. Administrators should upgrade immediately to one of these versions. As a temporary workaround prior to patching, consider implementing email gateway filtering rules to strip or quarantine emails containing SVG content with animate-family elements. Monitoring inbound emails for SVG payloads with attributeName values of href, mask, or cursor can help detect exploitation attempts (Roundcube News, GitHub Advisory).

The vulnerability was reported to Roundcube by security researcher "nullcathedral," who also identified two related bypasses (via crafted body background attributes and !important CSS) patched in the same release batch (Roundcube Release 1.6.14). Red Hat tracked the issue via Bugzilla and the vulnerability was indexed by ENISA's EUVD database (EUVD-2026-18589), indicating broad vendor awareness. No significant social media controversy or major media coverage has been identified beyond standard vulnerability aggregator reporting.