The identified issue allows a remote attacker to bypass Roundcube Webmail’s image blocking feature by embedding an SVG file in an email. The SVG uses an animate element whose attributeName can be set to fill, filter, or stroke, which the server mistakenly interprets as a remote image reference. This unintended processing exposes sensitive content or permits an attacker to circumvent access controls, resulting in information disclosure.

The vulnerability affects all installations of Roundcube Webmail prior to versions 1.5.15 and 1.6.15, including the 1.7‑rc6 release line. Users running these versions should review the vendor’s advisory for update instructions.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available and the issue is not currently listed in the CISA KEV catalogue. Exploitation requires delivery of a crafted email containing SVG content, which can be achieved through normal email traffic, making the risk realistic for exposed or open mail servers. Although no publicly known exploits exist yet, the moderate score and lack of mitigation options suggest the vulnerability is actionable.