CVE-2026-25916
Advisory lineage Upstream: 0 Downstream: 5
Awaiting Analysis
Published: 09 Feb 2026, 08:14
Last modified:09 Feb 2026, 15:05
Vulnerability Summary
Overall Risk (default)
low
17/100 CVSS Score
4.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.03% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
09 Feb 2026, 08:14
Published
Vulnerability first disclosed
09 Feb 2026, 15:05
Last Modified
Vulnerability information updated
Description
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
CVSS Metrics
- v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Trends
Current EPSS score: 0.03%• Percentile: 10%
Techniques & Countermeasures
- CWE-420•Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
Affected Systems
- roundcube•webmail
< 1.5.13 | ≥ 1.6.0, < 1.6.13