CVE-2026-114729
Description
A flaw was found in Roundcube Webmail. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing Scalable Vector Graphics (SVG) animations with an unvalidated animation attribute. The application's HTML sanitizer fails to inspect this attribute for remote links, causing external resources to load automatically without recipient consent. This bypasses the remote content protection mechanism and results in information disclosure, revealing the user's IP (Internet Protocol) address and confirming that the message was opened.
Statement
A flaw was found in Roundcube Webmail's HTML sanitizer (rcube_washtml). SVG SMIL animation attributes were inspected for remote URIs (to, from, and values in 1.6/1.7) but not by, so a crafted HTML email could load remote content without the recipient's consent, bypassing the remote-content blocker and disclosing the client IP address and confirming the message was opened. Upstream fixed in 1.6.20 and 1.7.5.
Mitigation
Update to roundcubemail 1.6.20 (1.6 LTS) or 1.7.5 per the upstream security updates of 2026-10-19. Disabling remote-content display reduces exposure, though the default remote-content blocker is the affected protection.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
