This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-75000 →

DEBIAN-CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image b...

Original description

The description as published by the source.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u11"}]}]

Debian:13 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18+dfsg-0+deb13u1"}]}]

Debian:14 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18+dfsg-1"}]}]

References

advisory security-tracker.debian.org