Roundcube Webmail CVE-2026-114728

Exploitation requires the victim to open/view a malicious HTML email inside a vulnerable Roundcube Webmail instance (before 1.6.20, or 1.7.x before 1.7.5) that relies on the built-in remote-content blocker. The attacker must encode the url() FuncIRI token using CSS Syntax Level 3 escape sequences - hex escapes such as \000075rl( or u\72 l(, or literal backslash escapes like u\rl( - placed in a presentation attribute (e.g. fill) or smuggled through an SVG SMIL animation's values, to, from, or by attributes, which rcube_washtml previously did not all inspect. Limiting factors: impact is confined to unconsented remote content loading (privacy/tracking leakage of read status and client IP), there is no confidentiality of stored data, integrity, or availability impact; HTML message rendering must be enabled and the user must display the message; only unpatched versions are affected.

This is a genuine but low-urgency issue, and the signals are internally consistent at the medium level. The NVD CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects the reality: the only impact is confidentiality (C:L) - an attacker learns that a message was opened and can harvest the victim's IP/client data via a tracking beacon. There is no integrity or availability impact and no code execution. EPSS is NOT provided in the input, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - this is a defense-in-depth filter bypass, not a widely-weaponized flaw. One signal conflict to verify: the CVSS vector states UI:N, but the vulnerability is about remote content loading from an HTML message, which in practice requires the victim to open/view that message - so the 'no user interaction' metric is questionable and I have independently reassessed it as UI:R below. In short, this is a legitimate privacy/anti-tracking regression that should be patched on normal maintenance cadence, not a high-real-risk emergency despite the network attack vector.

An attacker sends a crafted HTML email in which a url() FuncIRI is obfuscated with CSS escape sequences (e.g. \000075rl( or u\72 l() inside a fill attribute or an SVG SMIL animation's to/from/by value. Because rcube_washtml only recognized a few escaped spellings, the remote URL slips past the content blocker and the victim's mail client fetches it automatically when the message is viewed, leaking read-receipt and IP/client metadata to the attacker without consent. No standalone public exploit is identified at time of analysis, but the upstream fix commit publicly includes working bypass payloads in its test cases.