CVE-2026-75000 affects Roundcube Webmail versions prior to 1.6.18 and 1.7.x prior to 1.7.3. The vulnerability arises from inadequate HTML/CSS sanitization of the SVG animate "by" attribute, which can be exploited to bypass remote image blocking mechanisms. This bypass can enable attackers to disclose information or escalate privileges within the affected application environment. The CVSS 3.1 base score is 5.8, indicating a medium severity level. There are no known exploits in the wild and no explicit patch links or vendor advisories provided in the input data.

The vulnerability allows bypassing of remote image blocking, which may lead to unauthorized information disclosure or privilege escalation. The impact is rated as medium severity with a CVSS score of 5.8. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting SVG content or disabling SVG animations if feasible to reduce exposure.