« Back to list

CVE-2026-25916

Status: DeferredMedium (4.3)—

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Roundcube — WebmailAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-25916",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25916",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-09T14:54:49.903109Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Roundcube",
          "product": "Webmail",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.5.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.6.0",
              "lessThan": "1.6.13",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-09T09:16:34.193",
  "references": [
    {
      "url": "https://github.com/roundcube/roundcubemail/commit/26d7677",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://news.ycombinator.com/item?id=46937012",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-420"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage."
    },
    {
      "lang": "es",
      "value": "Roundcube Webmail antes de 1.5.13 y 1.6 antes de 1.6.13, cuando se usa 'Bloquear imágenes remotas', no bloquea SVG feImage."
    }
  ],
  "lastModified": "2026-06-17T10:25:25.333",
  "sourceIdentifier": "cve@mitre.org"
}