VYPR
Get started
← All advisories
Medium severity5.3NVD Advisory· Published Apr 3, 2026· Updated Apr 7, 2026

CVE-2026-35545

CVE-2026-35545

Description

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
roundcube/roundcubemailPackagist
>= 1.7-beta, < 1.7-rc51.7-rc5

Affected products

1

Patches

3
fe1320b199d3

Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

https://github.com/roundcube/roundcubemailAleksander MachniakMar 29, 2026via ghsa
commit
3 files changed · +7 −1
  • CHANGELOG.md+1 −0 modified
    @@ -5,6 +5,7 @@
 - Fix so distribution packages (and composer.json) don't include development dependencies
 - Fix regression where mail search would fail on non-ascii search criteria (#10121)
 - Fix regression where some data url images could get ignored/lost (#10128)
+- Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
 
 ## Release 1.5.14
  • program/lib/Roundcube/rcube_washtml.php+2 −1 modified
    @@ -547,7 +547,8 @@ private static function is_insecure_tag($node)
             return true;
         }
 
-        return self::attribute_value($node, 'attributeName', '/^(mask|cursor)$/i')
+        $rx = '/^(mask|cursor|fill|filter|stroke|clip-path|marker-start|marker-end|marker-mid)$/i';
+        return self::attribute_value($node, 'attributeName', $rx)
             && self::attribute_value($node, 'values', '/url\(/i');
     }
  • tests/Framework/Washtml.php+4 −0 modified
    @@ -514,6 +514,10 @@ function data_wash_svg_tests()
                     . ' feel="freeze" dur="1s" /></svg>',
                 '<svg><!-- animate blocked --></svg>',
             ],
+            [
+                '<svg><animate attributeName="fill" values="url(http://external.site)" dur="1s" begin="0s" fill="freeze" /></svg>',
+                '<svg><!-- animate blocked --></svg>',
+            ],
         ];
     }
9d18d524f3cc

Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

https://github.com/roundcube/roundcubemailAleksander MachniakMar 29, 2026via ghsa
commit
3 files changed · +7 −1
  • CHANGELOG.md+1 −0 modified
    @@ -4,6 +4,7 @@
 
 - Fix regression where mail search would fail on non-ascii search criteria (#10121)
 - Fix regression where some data url images could get ignored/lost (#10128)
+- Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
 
 ## Release 1.6.14
  • program/lib/Roundcube/rcube_washtml.php+2 −1 modified
    @@ -550,7 +550,8 @@ private static function is_insecure_tag($node)
             return true;
         }
 
-        return self::attribute_value($node, 'attributeName', '/^(mask|cursor)$/i')
+        $rx = '/^(mask|cursor|fill|filter|stroke|clip-path|marker-start|marker-end|marker-mid)$/i';
+        return self::attribute_value($node, 'attributeName', $rx)
             && self::attribute_value($node, 'values', '/url\(/i');
     }
  • tests/Framework/Washtml.php+4 −0 modified
    @@ -521,6 +521,10 @@ function data_wash_svg_tests()
                     . ' feel="freeze" dur="1s" /></svg>',
                 '<svg><!-- animate blocked --></svg>',
             ],
+            [
+                '<svg><animate attributeName="fill" values="url(http://external.site)" dur="1s" begin="0s" fill="freeze" /></svg>',
+                '<svg><!-- animate blocked --></svg>',
+            ],
         ];
     }
7ad62de18436

Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

https://github.com/roundcube/roundcubemailAleksander MachniakMar 29, 2026via ghsa
commit
3 files changed · +7 −1
  • CHANGELOG.md+1 −0 modified
    @@ -9,6 +9,7 @@ This file includes only changes we consider noteworthy for users, admins and plu
 - Stricter recognition of an Ajax request (#10118)
 - Password: Added Stalwart driver (#10114)
 - Fix regression where some data url images could get ignored/lost (#10128)
+- Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
 
 ## 1.7-rc5
  • program/lib/Roundcube/rcube_washtml.php+2 −1 modified
    @@ -544,7 +544,8 @@ private static function is_insecure_tag($node)
             return true;
         }
 
-        return self::attribute_value($node, 'attributeName', '/^(mask|cursor)$/i')
+        $rx = '/^(mask|cursor|fill|filter|stroke|clip-path|marker-start|marker-end|marker-mid)$/i';
+        return self::attribute_value($node, 'attributeName', $rx)
             && self::attribute_value($node, 'values', '/url\(/i');
     }
  • tests/Framework/WashtmlTest.php+4 −0 modified
    @@ -538,6 +538,10 @@ public static function provide_wash_svg_tests_cases(): iterable
                     . ' feel="freeze" dur="1s" /></svg>',
                 '<svg><!-- animate blocked --></svg>',
             ],
+            [
+                '<svg><animate attributeName="fill" values="url(http://external.site)" dur="1s" begin="0s" fill="freeze" /></svg>',
+                '<svg><!-- animate blocked --></svg>',
+            ],
         ];
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

1