CVE-2026-25916
Medium · 4.3CVSS
4.3
EPSS
0.5%
Published
Feb 9, 2026
CISA due date
—
The record
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | roundcubemail | 0 | 1.6.13-bp160.1.1 |
Related vulnerabilities
- CVE-2026-35537 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Also affects roundcubemail
- CVE-2026-26079 Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)… Also affects roundcubemail
- CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting… Also affects roundcubemail
- CVE-2025-68460 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information… Also affects roundcubemail
- CVE-2026-40435 When configured, IP-based access restrictions for httpd do not cover all endpoints, which… CWE-420
- CVE-2026-43505 An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5… CWE-420
- CVE-2026-40217 LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode… CWE-420
- GHSA-3926-2jvf-fg29 Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail CWE-420