Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02d
- https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
FAQ
What is CVE-2026-114729?
CVE-2026-114729 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but ...
How severe is CVE-2026-114729?
CVE-2026-114729 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114729?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.