CVE-2026-25916

Impact

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/roundcube/roundcubemail/commit/26d7677
• https://news.ycombinator.com/item?id=46937012
• https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/