Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when Block remote images is used, does not block SVG feImage.
Weakness
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Roundcube | Ubuntu | devel | * |
| Roundcube | Ubuntu | esm-apps/bionic | * |
| Roundcube | Ubuntu | esm-apps/focal | * |
| Roundcube | Ubuntu | esm-apps/jammy | * |
| Roundcube | Ubuntu | esm-apps/noble | * |
| Roundcube | Ubuntu | jammy | * |
| Roundcube | Ubuntu | noble | * |
| Roundcube | Ubuntu | questing | * |
| Roundcube | Ubuntu | upstream | * |