CVE-2026-75000

Executive Summary

CVE-2026-75000 is an improper HTML/CSS sanitization vulnerability in Roundcube Webmail affecting versions before 1.6.18 and all 1.7.x releases before 1.7.3. A remote, unauthenticated attacker can craft an HTML email containing an SVG <animate> element with an abnormal by attribute that survives Roundcube's content sanitizer, causing the built-in remote image blocker to be bypassed. Successful exploitation results in information disclosure (e.g., read receipt, IP/User-Agent leakage via beacon requests) and may lead to privilege escalation within the victim's webmail session. The attack requires no authentication and only that a user opens the message in Roundcube, making any internet-exposed Roundcube deployment a viable target.

Technical Analysis

The vulnerability class is improper sanitization of active HTML/CSS content (CWE-669 — Incorrect Resource Transfer Between Spheres). Roundcube processes inbound HTML email by stripping or neutralizing elements that can load remote content or execute logic, preserving a policy that blocks remote images to prevent web beacons and tracking pixels. Per the NVD description, the SVG animate element's by attribute is not correctly sanitized. SVG <animate> is a SMIL animation element; its by attribute defines a relative offset for the animation. When malformed or combined with other SVG constructs, the attribute can be used to construct a rendered document in which the email client issues outbound resource requests that should have been blocked by the remote image policy.

Because the sanitizer permits the by attribute to pass through (or fails to normalize it correctly during CSS/HTML filtering), the malicious SVG retains the ability to reference and load external resources. The result is a "remote image blocking bypass": content from an attacker-controlled host is fetched by the victim's browser within the authenticated Roundcube session context. This constitutes an incorrect transfer of resources between trust spheres — the untrusted email content reaches the trusted rendering context of the webmail application, and the victim's client contacts an attacker-controlled endpoint without consent.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N confirms the risk profile: the vulnerability is network-exploitable with no authentication and no user interaction beyond the standard action of viewing an email. The Scope (S:C) component indicates that the compromised component (HTML rendering) can impact an adjacent component (the webmail application session). Confidentiality impact is Low, consistent with read-receipt/metadata exfiltration; integrity and availability are listed as "None" for the direct primitive, though the NVD narrative warns of potential privilege escalation when the bypass is chained. At the time of writing, no public PoC code, Nuclei template, or in-the-wild exploit evidence has been observed, and FIRST has not yet issued an EPSS score for this CVE.

Exploitation Scenarios

Since no public exploit exists, the attack chain below is inferred strictly from the NVD description and the vulnerability class. No specific Roundcube functions, endpoints, or file paths are referenced in the CVE data, so those details are intentionally omitted.

1. Reconnaissance / target identification. The attacker identifies internet-exposed Roundcube Webmail instances (e.g., via Shodan using the dorks listed in the metadata, or by fingerprinting the Roundcube login page and version banner). Any organization exposing Roundcube as its webmail frontend is a candidate; mail-rich sectors (government, healthcare, finance) are high-value targets.

2. Trigger / message delivery. The attacker crafts an HTML email embedding an SVG animation block, tampering with the by attribute of the <animate> element so that it passes through Roundcube's HTML/CSS sanitizer unchanged. The email is sent to the victim's mailbox. No account compromise or prior authentication is required — the attacker only needs the ability to deliver email, which is inherent to any mail server.

3. Payload / execution mechanism. When the victim opens the message in Roundcube's HTML rendering view, the sanitized-but-still-active SVG causes the client to issue outbound requests to attacker-controlled hosts — effectively a remote image/web beacon load that should have been suppressed by the remote image blocking policy. At the vulnerability-class level, this is a resource-loading policy bypass achieved through incomplete sanitization of an HTML attribute.

4. Post-exploitation / impact. The attacker's logging infrastructure records each beacon request, confirming that the recipient read the email and capturing the victim's IP address, User-Agent, and approximate geolocation. Because the request is issued from within the user's authenticated webmail session, the attacker may be able to infer mailbox activity patterns, and the NVD description notes the bypass "may lead to information disclosure or privilege escalation" — for example, by chaining the SVG-based bypass with other client-side techniques to interact with the Roundcube application context.

It is acceptable to note: no public PoC is available; this chain is inferred from the vulnerability description and CWE-669 class behavior. Organizations should treat any inbound email containing <svg> with <animate by= anomalies as suspicious.

Impact Assessment

Business impact. The primary business risk is confidentiality: leakage of user activity data (email-open notifications, IP addresses, timestamps) to external parties. In environments where internal users, executives, or privileged accounts (e.g., shared mailboxes, admin mailboxes) are targeted, the read-receipt information can drive further social engineering or credential phishing campaigns. If the privilege-escalation path noted in the advisory is realized in future research, an attacker could potentially gain unauthorized access to mailbox contents or webmail administrative functions.

Affected systems. All Roundcube Webmail deployments below 1.6.18 and all 1.7.x builds below 1.7.3. These instances are commonly deployed as the webmail frontend for corporate IMAP servers, shared hosting providers, and government mail portals, often exposed on TCP/443 behind a reverse proxy.

Blast radius. The attack surface is the entire user population of an affected instance: any user who opens a crafted HTML email is a potential victim. No credentials are needed to deliver the malicious message, so the technical attack surface is the mail delivery path plus the webmail rendering engine. The CVSS scope change (S:C) indicates that the sanitizer bypass in the rendering component can affect the broader webmail application, widening the potential impact beyond the single HTML render. With a base score of 5.8, the vulnerability is rated Moderate, but its low skill barrier and email-delivery attack vector make it an attractive, low-cost espionage tool.

Detection Guidance

Detection should be layered: (1) inspect inbound email content for the SVG <animate> / by= pattern at the mail gateway; (2) monitor webmail and proxy logs for anomalous outbound HTTP requests from the webmail user interface to unknown external hosts immediately following message renders; (3) alert on HTML bodies served by the webmail application containing suspicious SVG animation markup.

Sigma Rule

title: Roundcube CVE-2026-75000 - Suspicious SVG animate by Attribute in Email
id: 6b8e2f0a-9c4e-4b6a-8f2e-c3d5e7a9b750
status: experimental
description: Detects inbound email messages containing an SVG animate element with a "by" attribute, indicating a possible CVE-2026-75000 exploitation attempt against Roundcube Webmail.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75000
author: ValtersIT Threat Intelligence
logsource:
    category: email
    product: smtp
detection:
    selection:
        message.body|contains|all:
            - '<svg'
            - '<animate'
            - 'by='
    filter_known_good:
        message.from|contains:
            - 'newsletter'
            - 'no-reply@'
    condition: selection and not filter_known_good
falsepositives:
    - Legitimate HTML newsletters using SVG animation
    - Marketing email templates with inline SVG
level: medium
tags:
    - attack.t1190
    - cve.2026-75000
    - cwe.669

YARA Rule

rule CVE_2026_75000_Roundcube_SVG_Animate_By
{
    meta:
        author      = "ValtersIT Threat Intelligence"
        description = "Detects HTML/EML/MIME content carrying an SVG <animate> element with a 'by' attribute, matching CVE-2026-75000 abuse"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-75000"
        cve         = "2026-75000"
    strings:
        $svg_tag   = /<svg[\s>]/i
        $anim_tag  = /<animate[\s>]/i
        $by_attr   = /[\s'\"]by[\s]*=/i
        $href_attr = /href[\s]*=/i
        $type_html = /content-type[\s]*:[\s]*text\/html/i
    condition:
        filesize < 5MB and
        $svg_tag and $anim_tag and $by_attr and
        ($href_attr or $type_html)
}

Suricata IDS Rule

# HTTP: malicious payload in webmail upload/submission or web proxy body
alert http any any -> any any (msg:"ET WEB_SERVER Roundcube CVE-2026-75000 SVG animate by Attribute in HTTP Request Body"; flow:established,to_server; content:"<svg"; nocase; http.request_body; content:"<animate"; nocase; http.request_body; content:"by="; nocase; http.request_body; distance:0; within:500; classtype:attempted-information-leak; reference:cve,2026-75000; sid:7500001; rev:1;)

# SMTP: inbound message body carrying the exploit pattern
alert smtp any any -> any any (msg:"ET POLICY Inbound SMTP with SVG animate by Attribute (CVE-2026-75000)"; flow:established,to_server; content:"<svg"; nocase; content:"<animate"; nocase; content:"by="; nocase; content:"Content-Type"; nocase; content:"text/html"; nocase; classtype:policy-violation; reference:cve,2026-75000; sid:7500002; rev:1;)

Elastic Detection

// EQL: web proxy / gateway logs carrying the sanitizer-bypass pattern
any where network.protocol == "http" and
  (http.request.body.content like "*<svg*" and
   http.request.body.content like "*<animate*" and
   http.request.body.content like "*by=*")

// EQL sequence: inbound malicious render followed by outbound beacon fetch (5-minute window)
sequence by user.name with maxspan=5m
  [ any where network.protocol == "http" and
      http.request.body.content like "*<animate*" and
      http.request.body.content like "*by=*" ]
  [ network where network.direction == "egress" and
      destination.domain != null and
      not startsWith(destination.domain, "roundcube.") and
      not startsWith(destination.domain, "gravatar.") ]

Splunk SPL Query

index=proxy OR index=webmail OR index=smtp
  (sourcetype="stream:http" OR sourcetype="smtp_data" OR sourcetype="iis")
| regex _raw="(?i)<svg"
| regex _raw="(?i)<animate"
| regex _raw="(?i)by\s*="
| eval cve_alert="CVE-2026-75000 (Roundcube SVG animate bypass)"
| eval severity="medium"
| table _time, src_ip, dest_host, url, user_agent, cve_alert, severity
| sort - _time

Wazuh OSSEC Rule

<group name="webmail,roundcube,cve-2026-75000,">
  <!-- Base indicator: SVG animate with by= attribute in web/mail logs -->
  <rule id="100751" level="6">
    <decoded_as>syslog</decoded_as>
    <match>SVG</match>
    <regex>animate</regex>
    <regex>by=</regex>
    <description>Roundcube CVE-2026-75000 indicator: SVG animate element with "by" attribute observed in webmail/mail log</description>
    <group>cve-2026-75000</group>
  </rule>

  <!-- Aggregation: repeated hits from same source -->
  <rule id="100750" level="10" frequency="3" timeframe="300" ignore="60">
    <if_matched_sid>100751</if_matched_sid>
    <description>Roundcube CVE-2026-75000: repeated SVG animate "by" attribute events from the same source</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve-2026-75000</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source, and no vendor advisory is available. The NVD description states the flaw exists "before 1.6.18 and 1.7.x before 1.7.3," which implies upstream awareness of fixed versions (1.6.18 / 1.7.3), but these must be verified against the official Roundcube source distribution before being trusted.

1. Immediate mitigations

   • Ensure Roundcube's remote image blocking feature is enabled and enforced for all users; the NVD description explicitly references this feature, and the flaw is a bypass of it.
   • Apply a temporary virtual patch at the WAF/mail-gateway layer: alert or drop inbound messages containing both <svg and <animate and by= (use the Sigma/YARA/Suricata rules above). Prefer blocking only on MIME parts of type text/html.
   • Deploy egress filtering on the webmail frontend: deny outbound HTTP/HTTPS from the webmail server to unknown external hosts, allowing only necessary destinations (e.g., patched-verified CDNs and internal resources). This suppresses the beacon call even if the bypass is triggered.
   • Consider forcing "show only text" rendering for messages from untrusted or unknown senders via Roundcube user/domain policies until a verified fix is deployed.

2. Patch / upgrade steps

   • Monitor the official Roundcube release page and mailing list for an advisory confirming the fixed versions (expected 1.6.18 and 1.7.3 per the NVD description).
   • Test the fixed release in a staging environment, then upgrade all production instances. Verify the installed version after upgrade (index.php?_task=about or the version file in the distribution).
   • Because the patch confidence rating is 0/4, do not assume a claimed fix is sufficient — validate that the SVG animate / by attribute no longer survives sanitization via a controlled test email.

3. Long-term hardening

   • Reduce the exposure of the webmail login page to the public internet where possible; place Roundcube behind a reverse proxy with authentication or VPN for internal users (lowers the practical attack surface even though no authentication is required to deliver the malicious email).
   • Establish a regular cadence for applying Roundcube maintenance releases; this product is frequently targeted by email-borne attacks and its sanitizer is a security boundary that must be kept current.
   • Add a Content Security Policy on the webmail frontend (e.g., img-src 'self' data: and default-src 'self') to constrain which remote hosts the rendering context may contact, complementing Roundcube's own image-blocking logic.
   • Subscribe to CVE/OSV feeds and the FIRST EPSS page for this CVE to gain early warning when public exploitation begins or an EPSS score is assigned.

References

1. NVD Entry — CVE-2026-75000: https://nvd.nist.gov/vuln/detail/CVE-2026-75000
2. MITRE CVE Record — CVE-2026-75000: https://www.cve.org/CVERecord?id=CVE-2026-75000
3. Roundcube Project — Official Site and Release News: https://roundcube.net/news/ and https://roundcube.net/download
4. FIRST EPSS — CVE-2026-75000 (not yet scored; monitor for updates): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-75000 as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor activity: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-75000 at the time of writing. The vulnerability's low exploitation complexity and email-delivery vector make it a candidate for inclusion in mass phishing toolkits once a PoC is published; SOC teams should treat the detection rules above as pre-emptive coverage.