CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

• CWE-184

• https://bugs.debian.org/1151279
• https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
• https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
• https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114723Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allow…3.7
• CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 conta…7.4
• CVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5
• CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.8
• CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passe…8.3
• CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-11473A vulnerability was identified in jflyfox jfinal_cms up to 5…6.3
• CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.…7.2
• CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…6.8
• CVE-2026-11474A security flaw has been discovered in Kushan2k student-mana…7.3
• CVE-2026-11475A weakness has been identified in Kushan2k student-managemen…6.3