CVE-2026-75000
Received Received - Intake

Improper SVG Sanitization in Roundcube Webmail

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: MITRE

Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-75000
EUVD
EUVD-2026-60167

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
roundcube roundcube to 1.6.18 (exc)
roundcube roundcube From 1.7.0 (inc) to 1.7.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3. It involves improper sanitization of the SVG animate 'by' attribute in HTML/CSS, which could allow bypassing remote image blocking. This may lead to information disclosure or privilege escalation.

Impact Analysis

An attacker could exploit this to bypass image blocking, potentially accessing sensitive information or gaining elevated privileges in the Roundcube Webmail system.

Compliance Impact

This vulnerability may lead to information disclosure or privilege escalation due to improper HTML/CSS sanitization in Roundcube Webmail. Such issues could potentially expose sensitive data, which may impact compliance with GDPR (data protection) or HIPAA (healthcare data privacy) if exploited.

Mitigation Strategies

Update Roundcube Webmail to version 1.6.18 or later if using the 1.6.x branch, or to version 1.7.3 or later if using the 1.7.x branch. This addresses the improper HTML/CSS sanitization issue in SVG animate attributes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart