Description (CNA)
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Roundcube / Webmail | affected 0 before 1.5.13; affected 1.6.0 before 1.6.13 |
CWE
CWE-420
References
- https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/
- https://github.com/roundcube/roundcubemail/commit/26d7677
- https://news.ycombinator.com/item?id=46937012
ADP enrichment
No English description supplied.
No references supplied.