CVE-2026-25916 - Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage

MEDIUM

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage

Published Feb 9, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.54%

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

Vendor Roundcube Product Webmail Default
unaffected
Affected
- ≥ 0, < 1.5.13
- ≥ 1.6.0, < 1.6.13

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Roundcube	Webmail	unaffected	Affected ≥ 0, < 1.5.13 ≥ 1.6.0, < 1.6.13

No remediation recorded yet.

Weaknesses (1)

CWE-420

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6937		Advisory
https://github.com/roundcube/roundcubemail/commit/26d7677
https://news.ycombinator.com/item?id=46937012
https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Feb 9, 2026

Updated Feb 9, 2026

Reserved Feb 9, 2026

CISA Vulnrichment

Updated Feb 9, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Feb 9, 2026

Updated Feb 9, 2026

GitHub

No data