CVE-2021-39220 json
Bypass of image blocking in Nextcloud Mail
published 2021-10-25 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-25593
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
Patch / fix
- nextcloud mail 1.10.4
- nextcloud-app-mail Arch Linux 1.10.5-1
arch linux advisories AVG-2495
- github.com/nextcloud/mail#5470 pull request
Exploit prediction
0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:P/I:N/A:N |
Affected products
- nextcloud security-advisories
Classification
References
-
github.com
/nextcloud/mail/pull/5470
patch, third-party-advisory
-
github.com
/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5
third-party-advisory
-
hackerone.com
/reports/1308147
permissions-required
Sources
- CVE List CVE-2021-39220
- NVD CVE-2021-39220
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.