UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream…

Severity
Medium 5.3
Published
22 Oct 2026
Last changed
26 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
CVE Program

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114729