DEBIAN-CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

DEBIAN-CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114729

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a remote content blocking bypass . The root cause is that the rcube_washtml function fails to inspect the by attribute within SVG SMIL animation tags, while it does check to, from, and URI values. This oversight all...

EUVD-2026-107996

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes "to", "from" and values for URIs, but not "by"; so markup such as in an HTML message caused remote content to be loaded without the user...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

EUVD-2026-107706

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-114728

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a remote content blocking bypass within the handling of FuncIRI attributes . The rcube_washtml function failed to recognize certain CSS escape sequences (e.g., \000075rl( or u\72 l() when detecting the url() token...

PT-2026-120963

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube washtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

PT-2026-120966

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube washtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

Linux Distros Unpatched Vulnerability : CVE-2026-114728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml...

Linux Distros Unpatched Vulnerability : CVE-2026-114729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes...

MGASA-2026-0507 Updated roundcubemail package fixes security vulnerabilities

Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai Fix CSS property injection via body background attribute, reported by zenithhostingevan Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo Fix email header...