CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.

• CWE-184

• https://bugs.debian.org/1151279
• https://github.com/roundcube/roundcubemail/commit/2f74267f0e13bed7182b1d2294cc4f3c5c46dcee
• https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
• https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114722Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…6.5
• CVE-2026-114723Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allow…3.7
• CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 conta…7.4
• CVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5
• CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.8
• CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passe…8.3
• CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-11473A vulnerability was identified in jflyfox jfinal_cms up to 5…6.3
• CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.…7.2
• CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…6.8
• CVE-2026-11474A security flaw has been discovered in Kushan2k student-mana…7.3