{"id":"CVE-2026-114729","kind":"vulnerability","aliases":["CVE-2026-114729"],"related":[],"title":"Roundcube Webmail: SVG animation attribute bypasses remote content blocking","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.","summary":"Roundcube's HTML sanitizer checked the SVG SMIL attributes to, from and values for URLs but missed by, so a crafted HTML email can load remote content without consent. The load discloses the reader's IP address and confirms the message was opened.","severity":"medium","cvss":5.3,"epss":0.00375,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","package","roundcube","self-hosted","webmail"],"not_affected_if":["default-config","plain-text-only"],"how_to_check":"- Check the installed version with `grep -i version /path/to/roundcube/program/include/iniset.php` (unknown exact command from sources)\n- Confirm whether the installed version is below `1.6.20` on the 1.6.x branch or below `1.7.5` on the 1.7.x branch","fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6.x branch, or to `1.7.5` or later on the 1.7.x branch\n- Apply the upstream commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute” if an upgrade is not possible","status":"open","published_at":"2026-10-22T03:16:38+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:35+00:00","updated_at":"2026-10-25T04:20:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6.x branch, or to `1.7.5` or later on the 1.7.x branch\n- Apply the upstream commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute” if an upgrade is not possible","reach":"internet","title":"Roundcube Webmail: SVG animation attribute bypasses remote content blocking","impact":"low","summary":"Roundcube's HTML sanitizer checked the SVG SMIL attributes to, from and values for URLs but missed by, so a crafted HTML email can load remote content without consent. The load discloses the reader's IP address and confirms the message was opened.","category":"package","nicknames":[],"who_cares":["roundcube","webmail","self-hosted","email"],"confidence":0.7,"needs_auth":"no","worst_case":"Sender learns reader's IP address and that the message was opened.","analyst_note":"","how_to_check":"- Check the installed version with `grep -i version /path/to/roundcube/program/include/iniset.php` (unknown exact command from sources)\n- Confirm whether the installed version is below `1.6.20` on the 1.6.x branch or below `1.7.5` on the 1.7.x branch","needs_analyst":false,"not_affected_if":["plain-text-only","default-config"],"who_is_affected":"Any Roundcube Webmail instance below the fixed versions that displays HTML email with remote content blocking enabled is exposed. Instances that only show plain-text mail, or that have the remote content blocker turned off, are not changed by this bypass.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3446,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114729':12A,15A '-2026':11A,14A '1.6.20':69C '1.7':71C '1.7.5':74C 'address':59B,123C 'affect':76C 'anim':4A,89C 'attribut':5A,31B,90C,147C 'block':9A,81C 'blocker':141C 'bypass':6A,82C,142C 'caus':108C 'check':27B 'client':121C 'commit':136C 'confirm':61B,125C 'consent':51B,118C 'content':8A,49B,80C,110C,140C 'craft':43B 'cve':10A,13A 'disclos':54B,119C 'email':16B,45B 'fix':132C,137C 'host':21B 'html':25B,44B,106C 'inspect':85C 'ip':58B,122C 'load':47B,53B,113C 'markup':101C 'messag':63B,107C,128C 'miss':39B 'open':65B,130C 'packag':17B 'rcube':83C 'reader':56B 'remot':7A,48B,79C,109C,139C 'remote-cont':138C 'roundcub':1A,18B,23B,66C 'sanit':26B 'self':20B 'self-host':19B 'smil':30B,88C,145C 'svg':3A,29B,87C,144C 'upstream':131C 'uri':96C 'url':37B 'user':116C 'valu':35B,94C 'via':143C 'washtml':84C 'webmail':2A,22B,67C 'without':50B,114C 'x':72C","nicknames":[],"mitigations":[],"who_affected":"Any Roundcube Webmail instance below the fixed versions that displays HTML email with remote content blocking enabled is exposed. Instances that only show plain-text mail, or that have the remote content blocker turned off, are not changed by this bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T03:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114729","severity":null,"published_at":"2026-10-22T03:16:38+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114729","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114729","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}