From 57de7eed1a0e6429312e48bc80137eb34835b7e1 Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Thu, 22 Oct 2026 18:19:52 +0200
Subject: [PATCH] Scramble foreignObject in SVG files

---
 .../v/0.0.0/app/libraries/RainLoop/Actions/Raw.php       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php
index ef73f9c7f..5a622909f 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php
@@ -219,14 +219,21 @@ trait Raw
 						\header('Content-Transfer-Encoding: binary');
 					}
 
+					// https://github.com/the-djmaze/snappymail/security/advisories/GHSA-cjq6-6gwv-qxjj
+					$bSVG = ('image/svg+xml' === $sContentType) || ('.svg' === \substr($sFileName, -4));
+
 					$sLoadedData = null;
-					if ($bIsRangeRequest || !$bDownload) {
+					if ($bIsRangeRequest || !$bDownload || $bSVG) {
 						$sLoadedData = \stream_get_contents($rResource);
 					}
 
 					\MailSo\Base\Utils::ResetTimeLimit();
 
 					if ($sLoadedData) {
+						if ($bSVG) {
+							$sLoadedData = \str_replace('foreignObject' ,'foreign-Object', $sLoadedData);
+						}
+
 						if ($bIsRangeRequest && (\strlen($sRangeStart) || \strlen($sRangeEnd))) {
 							$iFullContentLength = \strlen($sLoadedData);