{
  "cveId": "CVE-2026-114729",
  "url": "https://patchblox.com/security/cve/CVE-2026-114729",
  "summary": "CVE-2026-114729 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-114729, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass",
  "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes \u0060to\u0060, \u0060from\u0060 and values for URIs, but not \u0060by\u0060; so markup such as in an HTML message caused remote content to be loaded without the user\u0027s consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit \u201CFix remote-content blocker bypass via SVG SMIL \u0060by\u0060 attribute\u201D.",
  "published": "2026-10-22T03:16:38Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss": 0.00376,
  "epssPercentile": 0.31828,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.6.20\u002Bdfsg-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-114729",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-114729",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "roundcube",
      "release": "Debian 14",
      "fixedVersion": "1.6.20\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-114729",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-114729",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "roundcubemail",
      "release": "Fedora 43",
      "fixedVersion": "1.6.20-1.fc43",
      "fix": "FEDORA-2026-DB7E033531",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-db7e033531",
      "released": "2026-11-07T01:05:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}