Vulnerability · Published Oct 22, 2026 · Assigned by mitre
CVE-2026-114729
Medium 5.3
In plain English
A medium-severity security flaw in Webmail from Roundcube. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | no fix listed | DEBIAN-CVE-2026-114729 |
| Debian:13 | roundcube | 1.6.20+dfsg-0+deb13u1 | DEBIAN-CVE-2026-114729 |
| Debian:14 | roundcube | 1.6.20+dfsg-1 | DEBIAN-CVE-2026-114729 |
| Ubuntu:26.10 | roundcube | no fix listed | UBUNTU-CVE-2026-114729 |
Affected products (as reported)
Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://bugs.debian.org/1151279 issue-tracking, third-party-advisory
- https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05 patch
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 vendor-advisory, release-notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 release-notes, patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 release-notes, patch
- https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa patch