Cyber Resilience

CVE-2026-35545

Roundcube Webmail ≤ 1.5.15

Published
03 April 2026
Modified
24 July 2026
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0033 26th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2026-35545 is a medium-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Roundcube Webmail. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-35545 is a vulnerability in Roundcube Webmail versions prior to 1.5.15 and 1.6.15 that allows bypassing the remote image blocking feature through SVG content embedded in an email message. Specifically, the issue involves the SVG animate element using attributes such as attributeName=fill, filter, or stroke, which circumvents the intended blocking mechanism. This flaw is classified under CWE-669 (Incorrect Resource Transfer Between Spheres or Security Domains) and carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with low integrity impact.

The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. An attacker could send a specially crafted email containing malicious SVG content to a Roundcube user, bypassing image blocking to potentially disclose sensitive information or bypass access controls, such as loading external resources that reveal user data or enable further attacks.

Mitigation is addressed in Roundcube Webmail releases 1.5.15 and 1.6.15, with corresponding fixes in GitHub commits 7ad62de184368bf42c0f522d1aacc030f5ddcc46, 9d18d524f3cc211003fc99e2e54eed09a2f3da88, and fe1320b199d3a2f58351bb699c9ed4316e73221b. Security practitioners should update affected installations to these patched versions to prevent exploitation.

EU & UK References

Vulnerability Data

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element…

more

with attributeName=fill/filter/stroke.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-35540Same product: Roundcube Webmail
CVE-2026-35543Same product: Roundcube Webmail
CVE-2026-35542Same product: Roundcube Webmail
CVE-2026-35544Same product: Roundcube Webmail
CVE-2026-62642Same product: Roundcube Webmail
CVE-2026-35537Same product: Roundcube Webmail
CVE-2024-42009Same product: Roundcube Webmail
CVE-2025-68461Same product: Roundcube Webmail
CVE-2026-62641Same product: Roundcube Webmail
CVE-2026-35539Same product: Roundcube Webmail

Affected Assets

roundcube
webmail
≤ 1.5.15 · 1.6.0 — 1.6.15

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

Enforces approved information flow authorizations between system components and connected systems, directly stopping improper resource transfers across spheres.

Prevents unintended information leakage through shared system resources when crossing sphere boundaries.

Monitors and controls communications at external and key internal boundaries to block unauthorized transfers between trust domains.

Enforces logical access authorizations that limit resource transfers to only approved sphere crossings.

Separates user functionality from system management functions to avoid improper resource or behavior transfer between privilege spheres.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Least-privilege authorization policies directly constrain resource transfers across security domains.

PR.DS-02 partial match
prevents

Protecting data-in-transit can limit exposure during inter-sphere transfers but does not address control-flow or authorization errors.

PR.IR-01 partial match
prevents

Logical segmentation and access controls reduce unintended cross-sphere resource movement.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Environment separation limits unintended resource leakage between spheres.

degrades

Information-transfer rules can prevent improper resource hand-off between spheres.

degrades

Access-control policies limit unintended control over transferred resources.

degrades

Managing access rights reduces risk of unauthorized resource transfer.

mitigates

Network-security controls can block improper cross-sphere transfers.

mitigates

Network segregation directly limits unintended resource movement between spheres.

References