Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-17T13:16:54.580Z",
  "pubdate": "2026-08-17T13:16:54.580Z",
  "executiveSummary": "An improper HTML and CSS sanitization vulnerability exists in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3. The flaw resides within the handling of the SVG animate 'by' attribute, which allows malicious actors to construct crafted Scalable Vector Graphics payloads that bypass remote image blocking protections implemented by the webmail application. Successful exploitation of this vulnerability enables attackers to perform unauthorized external resource loading when victims view malicious messages. This remote image blocking bypass can subsequently serve as a vector leading to information disclosure or potential privilege escalation scenarios within the webmail context. The vulnerability affects specific versions of Roundcube Webmail and requires an authenticated or unauthenticated attacker, depending on the delivery vector, to transmit a specially crafted email containing the malicious SVG payload to a target user. Exploitation relies entirely on the victim rendering or interacting with the malicious HTML message containing the improperly sanitized SVG element. The risk implications include the potential tracking of user activity, exposure of client IP addresses and session metadata via external image requests, and chaining with further application-layer vulnerabilities to compromise user accounts.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient sanitization of HTML and CSS within SVG elements processed by the Roundcube Webmail rendering engine. Specifically, the parser fails to properly validate and neutralize malicious input vectors embedded within the SVG animate 'by' attribute. Scalable Vector Graphics support complex animation and styling features that, if not rigorously filtered against strict allowlists, can be leveraged to inject arbitrary attributes or execute behaviors that bypass security controls designed to prevent automatic loading of remote resources.\nThe vulnerable component is the HTML/CSS sanitization module responsible for stripping potentially dangerous tags, attributes, and styles from incoming email messages before rendering them in the user interface. Affected versions include Roundcube Webmail prior to 1.6.18 and versions in the 1.7.x branch prior to 1.7.3. The vulnerability does not inherently require prior authentication to the Roundcube application if the threat actor can deliver an external email to the victim's inbox, nor does it require elevated privileges on the target system; however, successful execution of the payload depends on the user viewing the crafted email message within the vulnerable Webmail interface, exposing the application to network-based content injection.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious email message containing an embedded SVG element. Within this SVG element, the attacker utilizes the animate 'by' attribute to inject specially formatted CSS or structural properties designed to evade the sanitization engine's pattern matching. When the Roundcube Webmail application processes the incoming HTML content, the deficient sanitization routine fails to strip or neutralize the malicious 'by' attribute. Second, the victim opens the crafted message in their webmail client. The browser parses the rendered HTML and executes the properties defined within the SVG animate element. Third, the browser attempts to load external resources referenced by the payload, successfully bypassing the application-level remote image blocking mechanism. Finally, the external resource request reaches the attacker-controlled server, resulting in information disclosure via IP address logging, user-agent harvesting, or unique token validation, which can facilitate further post-exploitation activities such as targeted session tracking or subsequent privilege escalation attacks."
}