Loading vulnerability…
SVG Remote Image Blocking Bypass in Roundcube Webmail
Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 improperly handles an unclosed url() expression in an SVG FuncIRI attribute. A crafted SVG image can bypass remote image blocking, potentially leading to information disclosure or privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses remote image blocking and may result in information disclosure or privilege escalation. The specific information exposed and the mechanism or extent of privilege escalation are not established.
If you can’t patch tonight, do this now.
Apply the vendor update. No separate workaround is specified. Until patched, restrict or sanitize untrusted SVG content and avoid rendering attacker-controlled SVG images where feasible.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), install Roundcube version 1.6.18+dfsg-0+deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.