CVE-2026-114728

Overview

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 contain a remote content blocking bypass via CSS escape sequences in FuncIRI attributes. Attackers can cause the client to load remote content from HTML messages without user consent, potentially exposing sensitive data. The issue was fixed in a recent commit that normalizes CSS escapes before matching.

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.

Impact

Confidentiality: remote content may be loaded, exposing user data. Integrity: content could be altered without detection. Availability: no direct impact. The vulnerability affects users of vulnerable Roundcube installations and administrators responsible for patching.

Remediation

Upgrade to Roundcube 1.6.20 or later, or 1.7.5 or later. Verify that content blocking is enabled and that FuncIRI handling follows the latest patch. Monitor for any custom CSS handling that may bypass the fix.

Risk context

Medium severity CVE with no EPSS data; moderate risk level. Timely patching is recommended to mitigate potential data exposure.

Affected products

• Roundcube Webmail 1.6.x
• Roundcube Webmail 1.7.x