Vulnerability Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | >= 1.6.0, < 1.6.18 |
Related Weaknesses (CWE)
References
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.18Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.3Release Notes
- https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3Vendor Advisory
FAQ
What is CVE-2026-75000?
CVE-2026-75000 is a vulnerability with a CVSS score of 5.8 (MEDIUM). In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to informat...
How severe is CVE-2026-75000?
CVE-2026-75000 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75000?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail.