CVE-2026-75003: Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI…
Critical 9.8 EPSS 0.4% Roundcube Webmail
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.
- CVE-2026-75003CVE identifier
- 9.8CVSS 3.1 base score (critical)
- 0.4%EPSS: chance of exploitation in the next 30 days (higher than 34% of CVEs)
- 2026-08-17published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Roundcube Webmail and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reload PHP-FPM / the web server after updating; check plugins and run bin/update.sh for tarball installs
Affected and fixed versions
Affected:
- Roundcube Webmail 1.6.0 to before 1.6.18
- Roundcube Webmail 1.7.0 to before 1.7.3
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade roundcube-coreUbuntu
sudo apt update
sudo apt install --only-upgrade roundcube-coreRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh roundcubemail (EPEL)Fedora
sudo dnf upgrade --refresh roundcubemailSUSE / openSUSE
sudo zypper refresh
sudo zypper update roundcubemailAmazon Linux
not in distro repos: vendor repositoryArch Linux
sudo pacman -SyuAlpine
not packaged: upstream tarballFreeBSD
pkg update && pkg upgrade roundcube-php84 (roundcube-phpXY)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | roundcube | fixed | 1.6.5+dfsg-1+deb12u11 |
| Debian 13 | roundcube | fixed | 1.6.18+dfsg-0+deb13u1 |
| Debian testing | roundcube | fixed | 1.6.18+dfsg-1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
- https://github.com/roundcube/roundcubemail/commit/1cebea03474305d9f75a9a33d30880d290b5591b
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
- https://github.com/roundcube/roundcubemail/commit/440277c32e6d84f3d116153af1cc8454361a8a56
- CVE-2026-75003 on CVE.org
- CVE-2026-75003 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.