Loading vulnerability…
Roundcube Webmail SVG Animation Remote Image Blocking Bypass
CVE-2026-75000 affects Roundcube Webmail before 1.6.18 and the 1.7 branch before 1.7.3. Improper HTML/CSS sanitization of the SVG animate element's "by" attribute allows crafted content to bypass remote image blocking. Successful exploitation may lead to information disclosure or privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers may bypass restrictions intended to prevent remote image loading, potentially resulting in information disclosure or privilege escalation. The specific information exposed and the mechanism or scope of privilege escalation are not established.
If you can’t patch tonight, do this now.
Apply the vendor security update. No separate workaround is specified. Until patched, restrict or disable processing of untrusted HTML email containing SVG content where operationally feasible, and maintain controls that limit external-resource retrieval.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), upgrade the Roundcube packages to version 1.6.18+dfsg-0+deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.