Remote Content Blocking Bypass in Roundcube Webmail by Ikon Technologies

CVE-2026-114728

What is CVE-2026-114728?

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 are susceptible to a remote content blocking bypass that compromises user consent. The vulnerability arises from the improper handling of FuncIRI attributes, where the rcube_washtml function fails to recognize certain CSS escape sequences. This oversight allows attackers to load remote content embedded in HTML messages, posing a risk of data exposure and further exploitation. The issue has been addressed in recent updates which improve the matching process by ensuring all CSS escape sequences are properly recognized and filtered.

References