Impact

The Nextcloud Mail application does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol.

Patches

It is recommended that the Nextcloud Mail application is upgraded to 1.10.4.

Workarounds

None.

References

• HackerOne
• Pull Request

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com