CVE-2026-114729
published 2026-10-22CVE-2026-114729: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.38%
30.3th percentile
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.20 | 1.6.20 |
| roundcube | webmail | >= 1.7.0 < 1.7.5 | 1.7.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass [epel-all]
bugzilla·2026-10-22·CVSS 5.3
CVE-2026-114729 [MEDIUM] CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass [epel-all]
CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker b
Bugzilla
CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass [fedora-all]
bugzilla·2026-10-22·CVSS 5.3
CVE-2026-114729 [MEDIUM] CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass [fedora-all]
CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker
https://bugs.debian.org/1151279https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efahttps://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05https://github.com/roundcube/roundcubemail/releases/tag/1.6.20https://github.com/roundcube/roundcubemail/releases/tag/1.7.5https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
2026-10-22
Published