Read the docs
TI-2021-12375 Aliases CVE-2021-32707

Bypass of image blocking in Nextcloud Mail

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist.

Why it matters now

EPSS 0.01146 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed security-advisories (nextcloud): 1.9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisoriesbefore 1.9.61.9.6Patch availableCNA
  • security-advisories Vendornextcloud Affected before 1.9.6 Fixed in 1.9.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*before 1.9.6Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:* Versions before 1.9.6 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 1.9.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32707

References

Exploit 1

Patch 1

Advisory 1

  • TI-2023-09741 Blind SSRF via server URL input in the Nextcloud Mail app CVSS 3.1MEDIUM 5.0
  • TI-2022-13176 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" CVSS 3.1CRITICAL 9.8
  • TI-2023-26170 Nextcloud Mail app vulnerable to Server-Side Request Forgery CVSS 3.1CRITICAL 9.8
  • TI-2021-12320 Missing permission check on email metadata retrieval CVSS 3.1HIGH 8.8
  • TI-2024-35179 Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers CVSS 3.1HIGH 8.2
  • TI-2020-06574 A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. CVSS 3.1HIGH 7.0
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences