CVE Catalog
CVE-2026-75000
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk0.32%
25th percentile - higher than 25% of all known CVEs
Summary
Roundcube Webmail before 1.6.18 and 1.7.3 has improper HTML/CSS sanitization of the SVG animate "by" attribute that may lead to remote image blocking bypass, potentially resulting in information disclosure or privilege escalation.
Risk Assessment
Risk of sensitive information disclosure or privilege escalation by bypassing remote image blocking protections.
Recommendation
Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 and implement additional content filters.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.