Roundcube Webmail versions before 1.5.13 and 1.6 before 1.6.13 contain a flaw where the Block remote images setting fails to neutralise SVG files that use the feImage element. When a user opens a message that contains such an SVG, the browser will retrieve the referenced remote image, potentially leaking sensitive data or executing malicious code. The weakness is an input validation flaw (CWE‑420).

Roundcube Webmail 1.5.x releases older than 1.5.13 and 1.6.x releases older than 1.6.13 when the Block remote images option is enabled are affected.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1 % implies a low likelihood of widespread exploitation at present. The vulnerability is listed as not included in the CISA KEV catalog. An attacker can potentially exploit the flaw by crafting a message with an SVG containing a feImage element that points to an external resource. The attack requires the victim to open the message in a client that renders SVG images, and it can be used to exfiltrate personal information or to bypass visual loading restrictions imposed by the Block remote images setting.