Medium severity · published Oct 22, 2026
CVE-2026-114729
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
New
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
1.6.0 before 1.6.20; 1.7.0 before 1.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114729
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114729
bugs.debian.org
https://bugs.debian.org/1151279
github.com
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
github.com
https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05
github.com
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
github.com
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
roundcube.net
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability