---
id: "CVE-2026-114729"
kind: "vulnerability"
aliases: ["CVE-2026-114729"]
title: "Roundcube Webmail: SVG animation attribute bypasses remote content blocking"
severity: "medium"
cvss: 5.3
epss: 0.00375
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "package", "roundcube", "self-hosted", "webmail"]
not_affected_if: ["default-config", "plain-text-only"]
published_at: "2026-10-22T03:16:38+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114729", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114729", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Roundcube Webmail: SVG animation attribute bypasses remote content blocking

Roundcube's HTML sanitizer checked the SVG SMIL attributes to, from and values for URLs but missed by, so a crafted HTML email can load remote content without consent. The load discloses the reader's IP address and confirms the message was opened.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `grep -i version /path/to/roundcube/program/include/iniset.php` (unknown exact command from sources)
- Confirm whether the installed version is below `1.6.20` on the 1.6.x branch or below `1.7.5` on the 1.7.x branch

## Fix

- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6.x branch, or to `1.7.5` or later on the 1.7.x branch
- Apply the upstream commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute” if an upgrade is not possible

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114729
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114729

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_