Vulnerability in Roundcube Webmail
CVE-2026-75000
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.
Affected products
- Roundcube Webmail — versions 1.6.0, 1.7.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-75000?
- CVE-2026-75000 is a medium-severity vulnerability in Roundcube Webmail, classified under Incorrect Resource Transfer Between Spheres. CVSS score: 5.8/10. Published 2026-08-17.
- How severe is CVE-2026-75000?
- Medium severity. CVSS v3 base score is 5.8 out of 10.