The vulnerability allows an attacker to bypass the remote image blocking feature in Roundcube Webmail by embedding SVG content with animate attributes inside an email. When the message is processed, the image loading restrictions are circumvented, potentially exposing sensitive data or allowing the attacker to gain elevated privileges. This is a type of information disclosure and access‑control bypass flaw.

Roundcube Webmail releases prior to version 1.5.14 and 1.6.14 are affected. The issue is present in the Roundcube Webmail application, which is distributed by the Roundcube vendor.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through crafted email messages designed to trigger the SVG bypass. An attacker would need to send such an email to a user who opens it, and the environment must have the remote image blocking feature enabled for the bypass to be relevant.