CVE-2026-114729CWE-184

CVE-2026-114729

Medium · published October 22, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-10-22T07:16Z
References (6)
https://bugs.debian.org/1151279 · [email protected]https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa · [email protected]https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 · [email protected]https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 · [email protected]
EPSS history
Timeline
  • 23 OCT 03:55Z
    EPSS moved — → 0%
    epss
  • 22 OCT 02:05Z
    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
    cvelistv5
  • 22 OCT 02:05Z
    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
    cvelistv5