CVE-2026-35542

Katalog CVE

CVSS 5.3 · Medium EPSS 0,53%

Kerentanan Incorrect Resource Transfer Between Spheres pada roundcube webmail. Skor CVSS 3.1 5.3 (Medium) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/e052328e3dc75f13adc2e314eaa4096ac21084ad patch
• https://github.com/roundcube/roundcubemail/commit/fd0e98178db5c73eaa93d005b561874923f9b0f0 patch
• https://github.com/roundcube/roundcubemail/commit/fde14d01adc9f37893cd82b635883e516ed453f8 patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 release notes