CVE-2022-36048

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews [disabled](https://zulip.com/help/allow-image-link-previews) are not affected.

• CWE-436

• https://github.com/zulip/zulip/security/advisories/GHSA-vg5m-mf9x-j452Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-vg5m-mf9x-j452Third Party Advisory

Published

Aug 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36041Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36042Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36043Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36044Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36045NodeBB Forum Software is powered by Node.js and supports eit…9.8
• CVE-2022-36046Next.js is a React framework that can provide building block…5.3
• CVE-2022-36049Flux2 is a tool for keeping Kubernetes clusters in sync with…7.5
• CVE-2022-3605The WP CSV Exporter WordPress plugin before 1.3.7 does not p…7.8
• CVE-2022-36051ZITADEL combines the ease of Auth0 and the versatility of Ke…8.8
• CVE-2022-36052Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36053Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36054Contiki-NG is an open-source, cross-platform operating syste…8.8