CVE-2026-114728: CWE-184 Incomplete List of Disallowed Inputs in Roundcube Webmail

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 contain a vulnerability where the remote content blocking mechanism (rcube_washtml) fails to recognize certain CSS escape sequences in FuncIRI attributes such as url() tokens. The pattern used to detect these tokens enumerated only some escaped spellings, missing others like \000075rl( or u\72 l(. As a result, remote content could be loaded from HTML messages without user consent. The upstream fix involved resolving CSS escapes before pattern matching and extending inspection to the 'to', 'from', and 'by' attributes to prevent bypass.

An attacker can bypass Roundcube's remote content blocking feature, causing remote content to be loaded automatically when a user views an HTML email. This can lead to privacy violations by revealing user information or triggering unwanted network requests. The CVSS score of 5.3 reflects a medium impact with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

A fix is available and has been implemented in Roundcube Webmail versions 1.6.20 and 1.7.5. Users and administrators should upgrade to these or later versions to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.