MSRXVulnerabilities / CVE-2026-114729
CVE-2026-114729
Published 2026-10-22 · published (not yet in NVD)
CVE-2026-114729
5.3 MEDIUM
CVSS 3.1 · CNA
CVSS 3.1 · CNA
0.4%
chance of exploitation in the next 30 days (EPSS; higher than 31% of CVEs)
chance of exploitation in the next 30 days (EPSS; higher than 31% of CVEs)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Scores
Affected products
- Roundcube Webmail: 1.6.0 to < 1.6.20; 1.7.0 to < 1.7.5
Weakness: CWE-184
6 references (advisories, patches, write-ups)
- https://bugs.debian.org/1151279 · issue-tracking, third-party-advisory
- https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05 · patch
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 · vendor-advisory, release-notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 · release-notes, patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 · release-notes, patch
- https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa · patch
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.