Roundcube Webmail implements a feature that blocks automatic loading of external images in e‑mails to protect user privacy. A flaw allows an attacker to embed an SVG file that includes animate attributes in an e‑mail. When the e‑mail is viewed, the SVG bypasses the blocking logic and triggers the client to fetch the referenced image, revealing the existence of the mailbox or exposing sensitive message details. The weakness aligns with improper handling of SVG data, classified as CWE‑669.

All installations of Roundcube Webmail running a version earlier than 1.5.14 or 1.6.14 are vulnerable. The issue covers the 1.5.x and 1.6.x series, as well as the 1.7‑rc5 release prior to its update.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The likely attack vector is a crafted e‑mail containing the malicious SVG sent to a user; upon opening the message, the client retrieves the remote image. This straightforward exploitation path means any environment where Roundcube is used as the webmail interface could expose users to information disclosure if they receive such messages.