CVE-2026-75003 affects Roundcube Webmail versions prior to 1.6.18 and 1.7.x before 1.7.3. The vulnerability arises from an unclosed url() in a FuncIRI attribute within an SVG image, which can evade the remote image blocking mechanism. This bypass could allow attackers to disclose information or escalate privileges within the affected application. The CVSS 3.1 base score is 5.8, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and a scope change with limited confidentiality impact.

Successful exploitation could lead to information disclosure or privilege escalation in the Roundcube Webmail environment. The vulnerability allows bypassing remote image blocking, potentially exposing sensitive data or enabling unauthorized actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting SVG image handling or disabling remote image loading as a temporary mitigation if feasible.