In Roundcube Webmail versions before 1.6.18 and before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image bypasses the remote image blocking feature. The flaw allows an attacker to embed a crafted SVG that the client loads, potentially enabling the attacker to read user data or influence privileged operations. This is identified as CWE-669, reflecting improper handling of search paths that can facilitate unauthorized access.

The affected product is Roundcube Webmail. All releases earlier than 1.6.18 and 1.7.3 are impacted; the security updates 1.6.18 and 1.7.3 fix the SVG handling logic.

The CVSS base score is 5.8, indicating moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation at this point. The likely attack vector is through a crafted message or web page that includes the malformed SVG; the attacker does not need elevated privileges to force the client to load the image, making the vulnerability remote in nature. An attacker could potentially read protected content or execute code within the client context, depending on other local vulnerabilities.