CVE-2026-114729 Roundcube CVE debrief

Who should care

Defenders responsible for Roundcube Webmail instances, security teams, and IT administrators should assess exposure and apply patches to prevent potential IP address disclosure. This includes reviewing and updating inventory of Roundcube Webmail instances to ensure they are running versions 1.6.20 or 1.7.5, and monitoring for potential suspicious activity related to SVG SMIL animation attributes.

Why it matters

CVE-2026-114729 is a remote content blocking bypass vulnerability in Roundcube Webmail that can potentially disclose client IP addresses. Defenders should prioritize verifying exposure and applying patches.

• Potential disclosure of client IP addresses
• Bypass of remote content blocking
• Verification of Roundcube Webmail instance exposure
• Patching priority for versions 1.6.20 and 1.7.5

Technical summary

The vulnerability is caused by the rcube_washtml function not inspecting the SVG SMIL animation attribute `by` for URIs, allowing remote content to be loaded without user consent. This can potentially disclose the client's IP address when a user opens a maliciously crafted HTML message. The issue affects Roundcube Webmail before versions 1.6.20 and 1.7.5, and was fixed in the commit 'Fix remote-content blocker bypass via SVG SMIL `by` attribute'. Defenders should prioritize verifying exposure of Roundcube Webmail instances and applying patches to prevent potential IP address disclosure.

Defensive priority

Defenders should prioritize verifying exposure of Roundcube Webmail instances and applying patches to prevent potential IP address disclosure.

Recommended defensive actions

• Verify Roundcube Webmail instance exposure and apply patches to prevent potential IP address disclosure
• Review and update inventory of Roundcube Webmail instances to ensure they are running versions 1.6.20 or 1.7.5
• Monitor for potential suspicious activity related to SVG SMIL animation attributes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and patches. However, there is limited information on potential exploitation or victim impact. Defenders should verify Roundcube Webmail instance exposure and apply patches to prevent potential IP address disclosure. The vulnerability was fixed in the commit 'Fix remote-content blocker bypass via SVG SMIL `by` attribute'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.