CVE-2026-114729
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but
Roundcube WebmailApplications & CMS
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL by attribute”.
Text from CVE List
Affected versions 2
- Webmailaffected: 1.6.0 before 1.6.20CVE List
- Webmailaffected: 1.7.0 before 1.7.5CVE List
References 6
- github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.7.5Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.6.20Fixvia CVE List
- github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efaFixvia CVE List
- bugs.debian.org/1151279Advisoryvia CVE List
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Advisoryvia CVE List