Description
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP Learn Manager Security Bypass (1.1.4)
PHP Improper Input Validation Vulnerability (CVE-2015-4148)
Drupal Improper Control of Dynamically-Managed Code Resources Vulnerability (CVE-2025-31674)
Oracle Database Server CVE-2012-1737 Vulnerability (CVE-2012-1737)
WordPress Plugin Cart66 Pro Arbitrary File Disclosure (1.5.3)