Search: CVE-2026-25916

CVE-2026-25916 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.13 and 1.6 before 1.6.13. When the 'Block remote images' feature is enabled, the application fails to block SVG feImage elements, allowing remote image content to be loaded. This unprotected alternate channel can be exploited to bypass privacy protections intended to prevent remote content loading, potentially leaking user information. The vulnerability does not impact integrity or availability and requires user interaction to trigger. No known exploits are currently reported in the wild.