Description
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.
References5
- github.com/roundcube/roundcubemail/commit/58e5263f341e6a418774f…
- github.com/roundcube/roundcubemail/commit/c960d102472dc579e1590…
- github.com/roundcube/roundcubemail/releases/tag/1.6.16
- github.com/roundcube/roundcubemail/releases/tag/1.7.1
- roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 33 · as of 14 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.