🛡️ openSUSE-SU-2026:20586-1 — roundcubemail (CVE-2026-35537)

Security update for roundcubemail

This update for roundcubemail fixes the following issues:

Changes in roundcubemail:

• update to 1.6.15

This is a security update to the stable version 1.6 of Roundcube Webmail.

It provides fixes to some regressions introduced in the previous release

as well a recently reported security vulnerability:

SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

This version is considered stable and we recommend to update all productive

installations of Roundcube 1.6.x with it. Please do backup your data before updating!

+ Fix regression where mail search would fail on non-ascii search criteria (#10121)

+ Fix regression where some data url images could get ignored/lost (#10128)

+ Fix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke (bsc#1261157)

• update to 1.6.14

This is a security update to the stable version 1.6 of Roundcube Webmail.

+ Fix Postgres connection using IPv6 address (#10104)

+ Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler

(bsc#1261488, CVE-2026-35537)

+ Security: Fix bug where a password could get changed without providing the old password

+ Security: Fix IMAP Injection + CSRF bypass in mail search

+ Security: Fix remote image blocking bypass via various SVG animate attributes

+ Security: Fix remote image blocking bypass via a crafted body background attribute

+ Security: Fix fixed position mitigation bypass via use of !important

+ Security: Fix XSS issue in a HTML attachment preview

+ Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts