CVE-2026-114729: Medium severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL by attribute”.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which Roundcube Webmail releases are affected?
Affected releases are versions before 1.6.20 and 1.7.x releases before 1.7.5.
What does an attacker need to exploit this issue?
An attacker needs to supply an HTML message containing SVG SMIL animation markup that uses the by attribute to reference a URI.
Does remote-content blocking prevent exploitation on affected versions?
No. The issue bypasses the remote-content blocker because URI inspection covered the to, from, and values attributes but not the SVG SMIL by attribute.
What information can be exposed through successful exploitation?
Remote content can be loaded without the user's consent, disclosing the client's IP address and allowing the attacker to confirm that the message was opened.