Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Published: 2026-10-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure via unauthorized remote content loading
Action: Patch
AI Analysis

Impact

The vulnerability in Roundcube Webmail allows a crafted email containing an SVG element that uses the SMIL "by" attribute to trigger remote content loading without the user’s consent. The rcube_washtml function inspects the SMIL attributes "to", "from" and URI values but ignores the "by" attribute, creating a bypass of the content‑blocking filter. This flaw exposes the client IP address and confirms that the message was opened, leading to information disclosure on user privacy.

Affected Systems

Roundcube Webmail versions older than 1.6.20 and any 1.7.x release earlier than 1.7.5 are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires a crafted email to be delivered and opened by the target user, meaning it relies on user interaction rather than an automated remote exploit.

Generated by OpenCVE AI on October 22, 2026 at 06:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Roundcube v1.6.20 or later, or v1.7.5 or later as provided by the vendor.
  • If an upgrade is not possible, configure the application to block or sanitize external SVG content, such as disabling SMIL animations or stripping external URI references.
  • Regularly monitor for and apply new security releases from the Roundcube project to prevent re‑exposure.

Generated by OpenCVE AI on October 22, 2026 at 06:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6579-1 roundcube security update
History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Remote Content Blocking Bypass via SVG SMIL 'by' Attribute in Roundcube Webmail roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Title Remote Content Blocking Bypass via SVG SMIL 'by' Attribute in Roundcube Webmail

Thu, 22 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Description Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
First Time appeared Roundcube
Roundcube webmail
Weaknesses CWE-184
CPEs cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Vendors & Products Roundcube
Roundcube webmail
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Roundcube Webmail
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-26T19:39:00.590Z

Reserved: 2026-10-22T02:05:39.353Z

Link: CVE-2026-114729

cve-icon Vulnrichment

Updated: 2026-10-26T19:17:37.507Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-22T03:16:38.070

Modified: 2026-11-04T01:53:17.947

Link: CVE-2026-114729

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-22T02:05:39Z

Links: CVE-2026-114729 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T06:45:17Z

Weaknesses
  • CWE-184

    Incomplete List of Disallowed Inputs