CVE-2026-75003

9.8 Critique

Publiée le 17/08/2026 à 15:16 · Modifiée le 10/09/2026 à 21:18 · Analysée par le NVD · Source : cve@mitre.org

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.

Traduire en français

Produits concernés

Roundcube Webmail

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.8 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N`
3.1	9.8 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-669

Références

https://github.com/roundcube/roundcubemail/commit/1cebea03474305d9f75a9a33d30880d290b5591b Patch
https://github.com/roundcube/roundcubemail/commit/440277c32e6d84f3d116153af1cc8454361a8a56 Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 Release Notes
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories