CVE-2026-114728: Medium severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the to, from and by attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to send an HTML email containing CSS FuncIRI attribute values that disguise a url() token with CSS escape sequences. No authentication or user interaction is required according to the supplied vector.
Who is exposed to the remote-content load?
Recipients using affected Roundcube Webmail versions are exposed when they view a crafted HTML message. The bypass can cause remote content to load without the recipient's consent, which may disclose limited information such as that the message was accessed.
Which releases are affected and which releases contain the fix?
Roundcube Webmail releases before 1.6.20 are affected, as are 1.7.x releases before 1.7.5. The stated fixed releases are 1.6.20 and 1.7.5.
What changed in the upstream fix?
The fix resolves CSS escapes before checking for url() and extends inspection to the to, from, and by attributes. This prevents escaped spellings such as \000075rl( and u\72 l( from bypassing remote-content blocking.