CVE Catalog
CVE-2026-75003
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk0.31%
23th percentile - higher than 23% of all known CVEs
Summary
Roundcube Webmail before 1.6.18 and 1.7.3 has an unclosed url() in a FuncIRI attribute of an SVG image that could evade remote image blocking, potentially leading to information disclosure or privilege escalation.
Risk Assessment
Risk of sensitive information disclosure or privilege escalation by bypassing remote image blocking mechanisms.
Recommendation
Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 and strengthen content security policy.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.