CVE-2021-39220

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.

• CWE-20
• CWE-200
• CWE-20

• https://github.com/nextcloud/mail/pull/5470Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5Third Party Advisory
• https://hackerone.com/reports/1308147Permissions Required
• https://github.com/nextcloud/mail/pull/5470Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5Third Party Advisory
• https://hackerone.com/reports/1308147Permissions Required

Published

Oct 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39215Jitsi Meet is an open source video conferencing application.…7.5
• CVE-2021-39216Wasmtime is an open source runtime for WebAssembly & WASI. I…6.3
• CVE-2021-39217OpenMage LTS is an e-commerce platform. Prior to versions 19…7.2
• CVE-2021-39218Wasmtime is an open source runtime for WebAssembly & WASI. I…6.3
• CVE-2021-39219Wasmtime is an open source runtime for WebAssembly & WASI. W…6.3
• CVE-2021-3922A race condition vulnerability was reported in IMController,…7
• CVE-2021-39221Nextcloud is an open-source, self-hosted productivity platfo…5.4
• CVE-2021-39222Nextcloud is an open-source, self-hosted productivity platfo…6.1
• CVE-2021-39223Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39224Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39225Nextcloud is an open-source, self-hosted productivity platfo…8.1
• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3