CVE-2026-75000

—

CVSS 3.1

5.8 medium

EPSS

<1%p28

Published

Aug 17, 2026 (29d ago)

Modified

Sep 8, 2026

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

Vendors: roundcube
Products: webmail
Weakness: CWE-669
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.