CVE-2026-114729
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
184
Incomplete List of Disallowed Inputs
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://bugs.debian.org/1151279
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02…
https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761…
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5