Live › vulnerability › CVE-2026-114729
Go to dashboardRoundcube's HTML sanitizer checked the SVG SMIL attributes to, from and values for URLs but missed by, so a crafted HTML email can load remote content without consent. The load discloses the reader's IP address and confirms the message was opened.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail instance below the fixed versions that displays HTML email with remote content blocking enabled is exposed. Instances that only show plain-text mail, or that have the remote content blocker turned off, are not changed by this bypass.
No product ranges from the sources yet.
grep -i version /path/to/roundcube/program/include/iniset.php (unknown exact command from sources)1.6.20 on the 1.6.x branch or below 1.7.5 on the 1.7.x branch1.6.20 or later on the 1.6.x branch, or to 1.7.5 or later on the 1.7.x branchby attribute” if an upgrade is not possibleEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL by attribute”.
This page as .md · .json · in your agent: get_signal("CVE-2026-114729")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.