What is CVE-2026-75003?

CVE-2026-75003 is a medium-severity vulnerability in Roundcube Webmail, classified under Incorrect Resource Transfer Between Spheres. CVSS score: 5.8/10. Published 2026-08-17.

How severe is CVE-2026-75003?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Vulnerability in Roundcube Webmail

CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Roundcube Webmail — versions 1.6.0, 1.7.0

Weakness classification (CWE)

CWE-669 — Incorrect Resource Transfer Between Spheres

References

cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2026-75003?: CVE-2026-75003 is a medium-severity vulnerability in Roundcube Webmail, classified under Incorrect Resource Transfer Between Spheres. CVSS score: 5.8/10. Published 2026-08-17.
How severe is CVE-2026-75003?: Medium severity. CVSS v3 base score is 5.8 out of 10.