Roundcube Webmail Vulnerability Allows Email Tracking Despite Image Blocking
By
nullcathedral
Master baker tier. Every paragraph earns its place on the tray.
Summary
Roundcube Webmail versions before 1.5.13 and 1.6.13 contain a security vulnerability (CVE-2026-25916) that allows attackers to bypass remote image blocking. The vulnerability exists in the HTML sanitizer which blocks external resources on standard image tags but fails to block them on SVG feImage elements. This enables attackers to track email opens even when users have "Block remote images" enabled. The issue has been fixed in the latest versions.
Key quotes
· 4 pulledRoundcube's rcube_washtml sanitizer blocked external resources on <img>, <image>, and <use>, but not on <feImage>
Attackers could track email opens even when 'Block remote images' was on
Roundcube's HTML sanitizer doesn't treat SVG feImage href as an image source
Fixed in 1.5.13 and 1.6.13
You might also wanna read
Critical Remote Code Execution Vulnerability Discovered in Widely Used protobuf.js Library
A critical remote code execution vulnerability has been discovered in protobuf.js, a widely used JavaScript implementation of Google's Proto
bleepingcomputer.com·1mo ago
Security Vulnerability in iTerm2: 'cat readme.txt' Command Can Enable Arbitrary Code Execution
The article reveals a security vulnerability in iTerm2 where the seemingly harmless command 'cat readme.txt' can be exploited for arbitrary
blog.calif.io·1mo ago
Windows Defender Vulnerability Allows Malicious File Persistence Through Cloud Tag Detection
The article describes a GitHub repository called 'RedSun' that documents a Windows Defender vulnerability. The vulnerability involves Window
github.com·1mo ago
PHP 8 Sandbox Escape Exploit: Use-After-Free Vulnerability Bypasses disable_functions
This article describes a PHP 8 sandbox escape proof-of-concept (PoC) that exploits a use-after-free vulnerability to bypass disable_function
github.com·2mo ago
Critical RCE Vulnerability in React Server Components Affects React 19.x and Next.js 15.x/16.x
A critical security vulnerability (CVE-2025-5518) affects React packages versions 19.0.0-19.2.0 and Next.js 15.x/16.x using App Router, allo
github.com·5mo ago
Critical Chromium Browser Vulnerability: DoS Attack via document.title API Exploitation
The article details 'Brash,' a critical vulnerability in Chromium-based browsers that allows denial-of-service attacks by exploiting the doc
github.com·7mo ago