CVE-2026-75000

5.8 mediumEPSS 0.5%

Medium (5.8) in roundcube webmail. EPSS 0.5% chance of exploitation in the next 30 days.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

Severity

CVSS 3.1

5.8 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-669
Published: 2026-08-17
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

Affected

roundcube:webmail

References

https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3

Check your stack JSON