This vulnerability in Roundcube Webmail affects versions prior to 1.5.15 and 1.6.15. The issue arises because the remote image blocking feature can be circumvented by embedding SVG content that uses the animate element with attributeName values of fill, filter, or stroke. This bypass can result in unauthorized information disclosure or access-control bypass, classified under CWE-669 (Incorrect Resource Transfer Between Spheres). The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity.

Successful exploitation allows an attacker to bypass the remote image blocking feature in Roundcube Webmail, potentially leading to information disclosure or unauthorized access control bypass. The impact does not include confidentiality loss or availability disruption according to the CVSS vector, but integrity may be affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening emails containing SVG content, especially those with animate elements manipulating fill, filter, or stroke attributes. No vendor advisory or official patch links are currently available.