🎯 New Report #3590576: SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent
🔺Severity: Medium
👽 Reporter: nullcathedral
⭐️ Reputation: 150
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-07
⏰ Disclosed: 2026-04-20 12:03:33
📝 Summary: A vulnerability was discovered in the HTML sanitizer of the Roundcube webmail client. The vulnerability allowed attackers to bypass the "Block remote images" security feature by using SMIL animation attributes to load arbitrary external resources without validation. This could have enabled email tracking without the user's consent.
📂 Report JSON File: 3590576
@hackeronereports