Bug 2558747 (CVE-2026-114729)
| Summary: | CVE-2026-114729 roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Roundcube Webmail. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing Scalable Vector Graphics (SVG) animations with an unvalidated animation attribute. The application's HTML sanitizer fails to inspect this attribute for remote links, causing external resources to load automatically without recipient consent. This bypasses the remote content protection mechanism and results in information disclosure, revealing the user's IP (Internet Protocol) address and confirming that the message was opened.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2559094, 2559095 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-22 02:43:26 UTC
|