← All advisories

Medium severity4.3NVD Advisory· Published Feb 9, 2026· Updated Apr 15, 2026

CVE-2026-25916

CVE-2026-25916

Description

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Roundcube/Roundcubemailreferences
Roundcube/Webmailllm-fuzzy
Range: <1.5.13, >=1.6.0 <1.6.13
osv-coords
pkg:rpm/opensuse/roundcubemail&distro=openSUSE%20Leap%2016.0
Range: < 1.6.13-bp160.1.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.