CVE-2026-75000

Published: Ago 17, 2026 Last Modified: Ago 17, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate 'by' attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

669

Incorrect Resource Transfer Between Spheres

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Application Data Modify Application Data Unexpected State
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/roundcube/roundcubemail/releases/tag/1.6…
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
https://github.com/roundcube/roundcubemail/releases/tag/1.7…
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
https://roundcube.net/news/2026/08/09/security-updates-1.6.…
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3