CVE-2021-39220: Bypass of image blocking in Nextcloud Mail
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-39220?
CVE-2021-39220 is a vulnerability in the Nextcloud Mail application that does not render images in emails to prevent leakage of read state or user IP.
How does CVE-2021-39220 impact Nextcloud Mail?
CVE-2021-39220 can allow an attacker to bypass the privacy filter in Nextcloud Mail and view images in emails, potentially disclosing read state or user IP.
What is the severity of CVE-2021-39220?
The severity of CVE-2021-39220 is low, with a severity value of 3.5.
How can I fix CVE-2021-39220 in Nextcloud Mail?
To fix CVE-2021-39220, update Nextcloud Mail to version 1.10.4 or later.
Where can I find more information about CVE-2021-39220?
You can find more information about CVE-2021-39220 on the Nextcloud Mail GitHub repository and HackerOne report.