Vulnerability in Roundcube Webmail
CVE-2026-114729
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- bugs.debian.org/1151279 (issue-tracking, third-party-advisory)
- github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9… (patch)
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 (release-notes, vendor-advisory)
- github.com/roundcube/roundcubemail/releases/tag/1.7.5 (release-notes, patch)
- github.com/roundcube/roundcubemail/releases/tag/1.6.20 (release-notes, patch)
- github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98… (patch)
Frequently asked questions
- What is CVE-2026-114729?
- CVE-2026-114729 is a medium-severity vulnerability in Roundcube Webmail, classified under Incomplete List of Disallowed Inputs. CVSS score: 5.3/10. Published 2026-10-22.
- How severe is CVE-2026-114729?
- Medium severity. CVSS v3 base score is 5.3 out of 10.