Remote Image Bypass in Roundcube Webmail by Ikon and Mace
CVE-2026-25916

4.3MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
9 February 2026

What is CVE-2026-25916?

Roundcube Webmail versions before 1.5.13 and 1.6 before 1.6.13 exhibit a vulnerability where the 'Block remote images' feature fails to effectively block SVG feImage elements. This shortcoming allows attackers to bypass image-blocking mechanisms, potentially leading to unauthorized image rendering and exploitation of user data. Users relying on image blocking for security may remain vulnerable to privacy breaches.

Affected Version(s)

Webmail 0 < 1.5.13

Webmail 1.6.0 < 1.6.13

References

https://nullcathedral.com/posts/2026-02-08-roundcube-svg-...
https://github.com/roundcube/roundcubemail/commit/26d7677
https://news.ycombinator.com/item?id=46937012

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.