CVE-2026-25916

CVE-2026-25916 describes a vulnerability in Roundcube Webmail versions prior to 1.5.13 and 1.6.13. When the "Block remote images" feature is enabled, it fails to block SVG feImage elements, potentially allowing for information disclosure. This is a medium-severity vulnerability (CVSS 4.3) with a low potential impact (C:L) and requires user interaction (UI:R) for exploitation. An attacker would need to craft a malicious email containing the SVG feImage element, which the user would then need to open. There is no evidence of active exploitation, nor are there publicly available exploit modules like Metasploit or Nuclei. Despite this, the vulnerability has garnered some community discussion and media coverage, primarily through security updates from openSUSE.