CVE-2026-35542

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.14 and prior to 1.6.14

Description A flaw exists in Roundcube Webmail that allows bypassing the remote image blocking feature. This bypass is achieved through a crafted background attribute within the BODY element of an email message. Successful exploitation could lead to information disclosure or access-control bypass.

Recommendations Update Roundcube Webmail to version 1.5.14 or later. Update Roundcube Webmail to version 1.6.14 or later.