Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.
Affected products
roundcube: webmail
References6
- github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04… Patch
- github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5… Patch
- bugs.debian.org/1151279 Third Party AdvisoryMailing List
- github.com/roundcube/roundcubemail/releases/tag/1.6.20 Release Notes
- github.com/roundcube/roundcubemail/releases/tag/1.7.5 Release Notes
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 Release Notes
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 32 · as of 8 November 2026
- CWE
- CWE-184
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.