Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | >= 1.6.0, < 1.6.20 |
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279Third Party AdvisoryMailing List
- https://github.com/roundcube/roundcubemail/commit/2f74267f0e13bed7182b1d2294cc4fPatch
- https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137fPatch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5Release Notes
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Issue TrackingRelease Notes
FAQ
What is CVE-2026-114728?
CVE-2026-114728 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern ...
How severe is CVE-2026-114728?
CVE-2026-114728 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114728?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail.