CVE-2026-35542: Roundcube Webmail remote image blocking bypass in BODY element

CVE-2026-35542 · Severity: medium · CVSS 5.3 · Published 2026-04-03

Roundcube Webmail, a popular open-source web-based email client, contains a security flaw in how it handles email content. An attacker can send a specially crafted email that bypasses the software's privacy feature designed to block remote images. This could allow an attacker to track when a user opens an email or potentially bypass certain access controls, compromising user privacy.

Technologies: roundcube/roundcubemail (Packagist), Roundcube Webmail. Vendors: Packagist, Roundcube.

Quick answers

Is CVE-2026-35542 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35542 being exploited in the wild.
How severe is CVE-2026-35542?
Medium severity, with a CVSS score of 5.3, published 3 April 2026.
Which products and versions are affected?
roundcube/roundcubemail (Packagist) ECOSYSTEM:introduced=1.7-beta,fixed=1.7-rc5; Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14.
Is there a fix for CVE-2026-35542?
Yes. roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35542 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-35542?
Check whether you run roundcube/roundcubemail (Packagist) or Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • roundcube/roundcubemail (Packagist): upgrade to 1.7-rc5 or later
    composer require roundcube/roundcubemail:^1.7-rc5

Technical details

A vulnerability in Roundcube Webmail's HTML sanitization library (rcube_washtml.php) allows for a bypass of remote image blocking. By using a crafted 'background' attribute within a 'BODY' element in an HTML email, an attacker can force the client to load external resources even when the 'block remote images' setting is enabled. This is classified as an Incorrect Resource Transfer Between Spheres (CWE-669). The attack is delivered via a standard email (network vector) and requires no special privileges or user interaction beyond viewing the message. This can be used for information disclosure (e.g., tracking user IP and read status) or access-control bypass. The issue is fixed in versions 1.5.14, 1.6.14, and 1.7-rc5.

Affected products

  • Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14

Identifiers

  • CVE-2026-35542
  • GHSA-5hf6-crg4-fg59

Timeline

  • 2026-03-18: patched: Security updates released in versions 1.5.14, 1.6.14, and 1.7-rc5.
  • 2026-04-03: disclosed: Initial CVE publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.