{"id":"CVE-2026-25916","aliases":["DEBIAN-CVE-2026-25916","DLA-4480-1","DSA-6137-1","EUVD-2026-6937","GHSA-q3rv-p5xv-cfpq","MGASA-2026-0065","UBUNTU-CVE-2026-25916","openSUSE-SU-2026:20323-1"],"status":"published","title":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does...","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00756,"percentile":0.55431,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-420"],"published":"2026-02-09T08:14:10Z","modified":"2026-10-28T02:30:32Z","exploits":[{"source":"pocgithub","id":"mbanyamer/CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute","title":"mbanyamer/CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute","date":"2026-02-09","url":"https://github.com/mbanyamer/CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute"}],"fixes":[{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.5+dfsg-1+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.13+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1ubuntu0.1~esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","fixed_in":["1.6.6+dfsg-2ubuntu0.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u7"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1+deb12u6","1.6.5+dfsg-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-0+deb13u1","1.6.12+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13+dfsg-1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-1"]},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1+deb11u7"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1+deb11u3","1.4.15+dfsg.1-1+deb11u4","1.4.15+dfsg.1-1+deb11u5","1.4.15+dfsg.1-1+deb11u6","1.4.15+dfsg.1-1~deb11u1","1.4.15+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u2","1.4.15+dfsg.1-1~deb11u2~bpo10+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u7"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2","1.6.4+dfsg-1","1.6.4+dfsg-1~deb12u1","1.6.5+dfsg-1","1.6.5+dfsg-1+deb12u2","1.6.5+dfsg-1+deb12u3","1.6.5+dfsg-1+deb12u4","1.6.5+dfsg-1+deb12u5","1.6.5+dfsg-1+deb12u6","1.6.5+dfsg-1~deb12u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13+dfsg-0+deb13u1"}]}],"versions":["1.6.11+dfsg-1","1.6.12+dfsg-0+deb13u1","1.6.12+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.14-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm8"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3","1.3.6+dfsg.1-1ubuntu0.1~esm4","1.3.6+dfsg.1-1ubuntu0.1~esm5","1.3.6+dfsg.1-1ubuntu0.1~esm6","1.3.6+dfsg.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm8"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3","1.4.3+dfsg.1-1ubuntu0.1~esm4","1.4.3+dfsg.1-1ubuntu0.1~esm5","1.4.3+dfsg.1-1ubuntu0.1~esm6","1.4.3+dfsg.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm6"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2","1.5.0+dfsg.1-2ubuntu0.1~esm3","1.5.0+dfsg.1-2ubuntu0.1~esm4","1.5.0+dfsg.1-2ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6+dfsg-2ubuntu0.1+esm3"}]}],"versions":["1.6.2+dfsg-1","1.6.4+dfsg-1","1.6.5+dfsg-1","1.6.6+dfsg-1","1.6.6+dfsg-2","1.6.6+dfsg-2ubuntu0.1","1.6.6+dfsg-2ubuntu0.1+esm1","1.6.6+dfsg-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.10+dfsg-1","1.6.10+dfsg-2","1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.11+dfsg-1","1.6.11+dfsg-1ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"bulwarkmail","product":"webmail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/","tags":["web","report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/26d7677","tags":["fix","report"]},{"url":"https://news.ycombinator.com/item?id=46937012","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25916","tags":["advisory"]},{"url":"https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass"},{"url":"https://github.com/advisories/GHSA-q3rv-p5xv-cfpq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25916.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25916","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0065.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35237","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.14","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-25916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25916","tags":["report"]},{"url":"https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8223-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255308","tags":["report"]},{"url":"https://bugzilla.suse.com/1257909","tags":["report"]},{"url":"https://bugzilla.suse.com/1258052","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26079","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-25916","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T08:14:10.177Z","modified":"2026-02-09T15:05:40.859Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-6937","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T08:14:10Z","modified":"2026-02-09T15:05:40Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:42.465921Z"}],"ghsa":[{"id":"GHSA-q3rv-p5xv-cfpq","title":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does...","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T09:30:22Z","modified":"2026-02-09T09:30:28Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:06:05.991559Z"}],"nvd":[{"id":"CVE-2026-25916","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T09:16:34.193Z","modified":"2026-06-17T10:25:25.333Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-25916","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T08:14:10.177Z","modified":"2026-10-28T02:30:32.989463597Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"DEBIAN-CVE-2026-25916","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T09:16:34.193Z","modified":"2026-10-01T03:03:00.430829305Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"UBUNTU-CVE-2026-25916","description":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","status":"published","published":"2026-02-09T09:16:00Z","modified":"2026-10-17T12:56:12.6951089Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"DLA-4480-1","title":"roundcube - security update","status":"published","published":"2026-02-17T00:00:00Z","modified":"2026-02-17T12:15:28.709065Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6137-1","title":"roundcube - security update","status":"published","published":"2026-02-17T00:00:00Z","modified":"2026-02-17T09:15:22.896506Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0065","title":"Updated roundcubemail packages fix security vulnerabilities","description":"Fix pre-auth arbitrary file write via unsafe deserialization in\nredis/memcache session handler, reported by y0us.\nFix bug where a password could get changed without providing the old\npassword, reported by flydragon777.\nFix IMAP Injection + CSRF bypass in mail search, reported by Martila\nSecurity Research Team.\nFix remote image blocking bypass via various SVG animate attributes,\nreported by nullcathedral.\nFix remote image blocking bypass via a crafted body background\nattribute, reported by nullcathedral.\nFix fixed position mitigation bypass via use of !important, reported by\nnullcathedral.\nFix XSS issue in a HTML attachment preview, reported by aikido_security.\nFix SSRF + Information Disclosure via stylesheet links to a local\nnetwork hosts, reported by Georgios Tsimpidas (aka Frey), Security\nResearcher at https://i0.rs/.\n","status":"published","published":"2026-03-24T17:53:34Z","modified":"2026-04-16T04:43:23.302368255Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:20323-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nChanges to roundcubemail:\n\nUpdate to 1.6.13:\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n  + Fix CSS injection vulnerability reported by CERT Polska (boo#1258052,\n    CVE-2026-26079).\n  + Fix remote image blocking bypass via SVG content reported by nullcathedral\n    (boo#1257909, CVE-2026-25916).\n\n  This version is considered stable and we recommend to update all productive\n  installations of Roundcube 1.6.x with it. Please do backup your data\n  before updating!\n\n  CHANGELOG\n  + Managesieve: Fix handling of string-list format values for date\n    tests in Out of Office (#10075)\n  + Fix CSS injection vulnerability reported by CERT Polska.\n  + Fix remote image blocking bypass via SVG content reported by nullcathedral.\n\nUpdate to 1.6.12:\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n\n  + Fix Cross-Site-Scripting vulnerability via SVG's animate tag\n    reported by Valentin T., CrowdStrike (boo#1255308, CVE-2025-68461).\n  + Fix Information Disclosure vulnerability in the HTML style\n    sanitizer reported by somerandomdev (boo#1255306, CVE-2025-68460).\n\n  This version is considered stable and we recommend to update all\n  productive installations of Roundcube 1.6.x with it.\n\n  + Support IPv6 in database DSN (#9937)\n  + Don't force specific error_reporting setting\n  + Fix compatibility with PHP 8.5 regarding array_first()\n  + Remove X-XSS-Protection example from .htaccess file (#9875)\n  + Fix \"Assign to group\" action state after creation of a first group (#9889)\n  + Fix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)\n  + Fix bug where an mbox export file could include inconsistent message delimiters (#9879)\n  + Fix parsing of inline styles that aren't well-formatted (#9948)\n  + Fix Cross-Site-Scripting vulnerability via SVG's animate tag\n  + Fix Information Disclosure vulnerability in the HTML style sanitizer\n\nUpdate to 1.6.11\n\n  This is a security update to the stable version 1.6 of Roundcube Webmail.\n  It provides fixes to recently reported security vulnerabilities:\n  * Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.\n\n- CHANGELOG\n  * Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)\n  * Improve installer to fix confusion about disabling SMTP authentication (#9801)\n  * Fix PHP warning in index.php (#9813)\n  * OAuth: Fix/improve token refresh\n  * Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)\n  * Fix HTML message preview if it contains floating tables (#9804)\n  * Fix removing/expiring redis/memcache records when using a key prefix\n  * Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)\n  * Fix a default value and documentation of password_ldap_encodage option (#9658)\n  * Remove mobile/floating Create button from the list in Settings \u003e Folders (#9661)\n  * Fix Delete and Empty buttons state while creating a folder (#9047)\n  * Fix connecting to LDAP using ldapi:// URI (#8990)\n  * Fix cursor position on \"below the quote\" reply in HTML mode (#8700)\n  * Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)\n\nUpdate to 1.6.10:\n\n  This is the next service release to update the stable version 1.6.\n  * IMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257)\n  * OAuth: Support standard authentication with short-living password received with OIDC token (#9530)\n  * Fix PHP warnings (#9616, #9611)\n  * Fix whitespace handling in vCard line continuation (#9637)\n  * Fix current script state after initial scripts creation in managesieve_kolab_master mode\n  * Fix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650)\n  * Fix regression causing inline SVG images to be missing in mail preview (#9644)\n  * Fix plugin \"virtuser_file\" to handle backward slashes in username (#9668)\n  * Fix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689)\n  * Fix insert_or_update() and reading database server config on PostgreSQL (#9710)\n  * Fix Oauth issues with use_secure_urls=true (#9722)\n  * Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728)\n  * Fix links in comments and config to https:// where available (#9759, #9756)\n  * Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725)\n","status":"published","published":"2026-03-05T18:31:03Z","modified":"2026-03-23T04:54:50.920443Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}