CVE-2026-114728 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x prior to 1.7.5 contain a critical security vulnerability related to remote content blocking mechanisms within its HTML sanitization engine. The flaw resides in the handling of FuncIRI attributes, specifically how the rcube_washtml component processes CSS url() tokens. This function is designed to prevent the automatic loading of external resources from untrusted sources by stripping or neutralizing such references before rendering email messages. However, the implementation relied on a pattern-based detection method that enumerated only specific escaped spellings of the word "url". Consequently, attackers could bypass this protection by utilizing alternative CSS escape sequences that were not included in the original enumeration list.
The technical root cause is an insufficient validation logic within the HTML parser. By relying on a static whitelist or limited regex pattern for detecting url() tokens, the application failed to account for all valid ways of encoding the string "url" according to CSS specifications. For instance, sequences such as \000075rl( or u\72 l( were interpreted literally rather than being resolved into their functional equivalent. This oversight allowed remote content references embedded in malicious HTML emails to pass through the sanitization filter undetected. As a result, when a user opened an infected message, the webmail client would automatically fetch external resources from attacker-controlled servers without any explicit consent or visual indication that such activity was occurring.
The operational impact of this vulnerability is significant for both end-users and organizations deploying Roundcube as their email interface. The primary risk involves privacy violations and potential data exfiltration through tracking pixels, which are commonly implemented via remote image requests. When these images load, they can transmit sensitive information back to the attacker, including the user's IP address, browser fingerprinting data, timestamp of access, and potentially cookie values if session cookies were accessible in that context. Furthermore, this bypass could facilitate broader attacks such as cross-site scripting or drive-by downloads if the remote content served malicious scripts or executable payloads instead of simple tracking pixels. The lack of consent for these network requests undermines user trust and exposes organizational networks to reconnaissance activities.
This vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, although in this specific instance the immediate effect is more aligned with unauthorized data transmission rather than script execution. It also relates to CWE-200 where an information exposure occurs due to improper handling of sensitive data during processing. From a tactical perspective, this behavior corresponds to ATT&CK technique T1567.002, specifically Steal Web Session Cookie via Browser Fingerprinting or Exfiltration Over C2 Channel if the remote server acts as a command and control endpoint for gathering intelligence on the victim's environment.
Upstream developers addressed this issue in commit titled Fix remote content blocking bypass via CSS escapes in FuncIRI attributes again by fundamentally changing how input is processed before validation. The fix ensures that all CSS escape sequences are resolved into their plain text equivalents prior to pattern matching against url() tokens. This approach guarantees that any variation of the word "url" encoded through standard CSS escaping mechanisms will be correctly identified and blocked. Additionally, the remediation expanded the scope of inspection to include attributes such as from, to, and by, ensuring a more comprehensive sanitization process for email metadata fields that could potentially carry similar injection vectors or tracking payloads.
To mitigate this risk in environments where upgrading is not immediately feasible, administrators should consider implementing strict Content Security Policy headers if supported by their deployment architecture, although client-side fixes are preferred given the nature of webmail applications. Network-level controls such as proxy servers can be configured to block outbound requests from Roundcube processes to unknown or untrusted domains, effectively neutralizing the impact even if the vulnerability is exploited. However, the most effective and permanent solution remains upgrading to version 1.6.20 or later for stable releases, or version 1.7.5 and above for development branches, ensuring that all known CSS escape bypasses are patched and that input validation covers a broader range of potential attack vectors including metadata attributes.