Live › vulnerability › CVE-2026-114728
Go to dashboardRoundcube's HTML sanitizer missed CSS-escaped spellings of url(), so remote images and resources in HTML messages loaded without the user's consent. An attacker can use this to learn when a message is opened and to track the reader.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail instance on a version before 1.6.20 or before 1.7.5 that displays HTML mail is exposed. Deployments that only show plain-text mail or that run a patched release can skip it.
No product ranges from the sources yet.
program/include/iniset.php file or the about page (RCMAIL_VERSION).1.6.20 on the 1.6 branch or 1.7.5 on the 1.7 branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the to, from and by attributes.
This page as .md · .json · in your agent: get_signal("CVE-2026-114728")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.