Back Linuxsecurity Debian 11 Roundcube Information Disclosure Update DLA-4480-1 CVE-2026
CVE-2026-25916 NULL CATHEDRAL discovered that the HTML sanitizer doesn't treat SVG ` ` as an image source. This allows attackers to bypass remote image blocking to track email open action or potentially bypass access control. CVE-2026-26079 CERT Polska discovered that CSS code in text/html emails were insufficiently sanitized, allowing an attacker to inject malicious stylesheet rules. For Debian 11 bullseye, these problems have been fixed in version 1.4.15+dfsg.1-1+deb11u7. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: Further information Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at:
CVE-2026-25916 NULL CATHEDRAL discovered that the HTML sanitizer doesn't treat SVG ` ` as an image source. This allows attackers to bypass remote image blocking to track email open action or potentially bypass access control. CVE-2026-26079 CERT Polska discovered that CSS code in text/html emails were insufficiently sanitized, allowing an attacker to inject malicious stylesheet rules. For Debian 11 bullseye, these problems have been fixed in version 1.4.15+dfsg.1-1+deb11u7. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: Further information Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
