Vulnerability in Roundcube Webmail

[ Description ]Official description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4043

  Roundcube Webmail: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-114720CVE-2026-114727CVE-2026-114732+16 more CVEs

[ References ]References

• bugs.debian.org/1151279
• github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
• github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05
• github.com/roundcube/roundcubemail/releases/tag/1.6.20
• github.com/roundcube/roundcubemail/releases/tag/1.7.5
• roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5