CVE-2026-114729
mediumRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass.
Vendor / product: Roundcube — webmail
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
CVSS
5.3
5.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (cve@mitre.org)
Timeline (UTC)
Published: 2026-10-22 03:16
Modified: 2026-11-04 01:53
NVD status: Analyzed
Last synced 23 hours ago
Verified against the source API 2026-11-04 01:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
roundcube / webmail ≥1.6.0 <1.6.20, ≥1.7.0 <1.7.5
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://bugs.debian.org/1151279 cve@mitre.org
- https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa cve@mitre.org
- https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05 cve@mitre.org
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 cve@mitre.org
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 cve@mitre.org
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 cve@mitre.org
Data sources
NVD CVE API 2.0 — fetched 2026-11-04 01:56 UTC · record ↗