CVE-2026-25916

Medium

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

mitre·CWE-420·Published 2026-02-09

CVSS

4.3

EPSS

0.01

KEV

Exploits

cve.orgen

118 chars

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

NVDen

118 chars

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

NVDes

123 chars

Roundcube Webmail antes de 1.5.13 y 1.6 antes de 1.6.13, cuando se usa 'Bloquear imágenes remotas', no bloquea SVG feImage.

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	4.3	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
3.1	Secondary	NVD	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N