Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-17T13:16:54.900Z",
  "pubdate": "2026-08-17T13:16:54.900Z",
  "executiveSummary": "An information disclosure and potential privilege escalation vulnerability exists in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3.\nThe vulnerability stems from improper sanitization of FuncIRI attributes within SVG images, specifically involving unclosed url() constructs.\nThis flaw allows remote attackers to bypass built-in remote image blocking mechanisms implemented by the webmail application.\nSuccessful exploitation enables unauthorized external resource loading, potentially leading to sensitive information disclosure and facilitating further attack vectors such as privilege escalation.\nThe attack requires an attacker to deliver a specially crafted SVG image containing the malicious FuncIRI payload to a victim who views it within the vulnerable Roundcube Webmail interface.\nThe risk implications include potential tracking of user activity, exposure of session metadata, or exploitation of secondary client-side vulnerabilities through forced interaction with external servers.",
  "technicalDetails": "The root cause of the vulnerability lies in the HTML and SVG sanitization logic within Roundcube Webmail, which fails to adequately parse and neutralize unclosed url() sequences inside the FuncIRI attribute of SVG elements.\nRoundcube implements a remote image blocking defense designed to prevent tracking pixels and unauthorized loading of external assets by stripping or neutralizing standard URI schemes in markup.\nHowever, the flawed handling of the FuncIRI attribute allows the unclosed url() syntax to bypass these sanitization routines during the rendering process.\nAttack flow involves the attacker sending an email containing the malicious SVG attachment or inline image to a target user.\nWhen the victim opens or previews the email, the Roundcube Webmail rendering engine processes the SVG markup.\nDue to the inadequate sanitization of the FuncIRI attribute, the rendering engine interprets the unclosed url() directive and initiates an outbound HTTP or network request to the attacker-controlled external server.\nThis behavior evades the remote image blocking feature, allowing the external resource to load successfully.\nThe affected components are the SVG sanitization and rendering subsystems in Roundcube Webmail versions prior to 1.6.18 and 1.7.3.\nExploitation does not require prior authentication to the Roundcube instance beyond standard email delivery, nor does it require administrative privileges, as it can be triggered by a standard user viewing a malicious message.\nThe network exposure involves client-side processing of untrusted email content within the webmail context.\nPost-exploitation impact includes unintended information disclosure via outbound requests—such as IP address logging, user-agent profiling, and potential session correlation—which may pave the way for subsequent privilege escalation or targeted social engineering attacks."
}