Roundcube Webmail EUVD-2026-107996

Exploitation requires the attacker to send a crafted HTML email in which an SVG SMIL <animate>/animation element uses the by attribute to carry a remote URI (plain URL or url(...)), and requires the victim to open/view that message in an affected Roundcube version (before 1.6.20, or 1.7.x before 1.7.5) that has remote-content blocking enabled - the default privacy protection this bug circumvents. Limiting factors: the bug only has value where remote-content blocking is active (otherwise content loads anyway), the victim must actually open the specific message, and the disclosure is limited to metadata (client IP and read confirmation) - no email content, credentials, or code execution is exposed. Sending the email needs no authentication to the victim's Roundcube instance.

This is a genuine but low-urgency privacy issue, not a system-compromise flaw. The NVD CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects only a limited confidentiality impact - disclosure of the victim's client IP address and confirmation that a message was opened (an email read-receipt / tracking-pixel style leak) via CWE-184 (incomplete disallowed-input list). There is no integrity or availability impact and no code execution. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so all three real-world exploitation signals are absent or neutral; the only exploitation evidence is the upstream fix commit's test cases demonstrating the malicious markup. One signal conflicts: NVD scored UI:N, but the description - 'confirming that the message was opened' - makes clear that the victim must open/view the crafted message for remote content to load, which is really user interaction (UI:R/UI:P); this inflates the NVD score slightly and should be treated as the lower-severity, interaction-dependent case. Net: a real, fix-worthy privacy/deanonymization bug suitable for routine patching, not an emergency.

An attacker sends the victim an HTML email containing an SVG with an <animate> element whose by attribute references an attacker-controlled URL (e.g. by="http://attacker.example/a"). When the victim opens the message in a vulnerable Roundcube version, the sanitizer fails to strip the by URI and the browser fetches the remote resource despite remote-content blocking, revealing the victim's IP address and confirming the message was read. No weaponized public exploit is identified, though the vendor's fix commit ships proof-of-concept test markup.