CVE-2026-35543

Katalog CVE

CVSS 5.3 · Medium EPSS 0,53%

Kerentanan Incorrect Resource Transfer Between Spheres pada roundcube webmail. Skor CVSS 3.1 5.3 (Medium) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/1a63e01542bff42aaa71c00c4c279a09ef31f20c patch
• https://github.com/roundcube/roundcubemail/commit/39471343ee081ce1d31696c456a2c163462daae3 patch
• https://github.com/roundcube/roundcubemail/commit/82ab5eca7b332fce7a174b2b987f0957a66377cd patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 release notes