CVE-2021-39220

    Dashboard / Vulnerabilities / CVE-2021-39220

    CVE-2021-39220

    Published: 25 Oct 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.

    References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5, https://hackerone.com/reports/1308147, https://github.com/nextcloud/mail/pull/5470

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f6780562b1d5a1ed49dbc58f3618b99c8639576f

    Affected versions

    v1.10.3
    v1.10.2
    v1.10.1
    v1.10.0
    v1.10.0-RC.2
    v1.10.0-RC.1
    v1.10.0-alpha.7
    v1.10.0-alpha.6
    v1.10.0-alpha.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39220 | CVE-DB