CVE-2021-39220

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-392215.4Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to CVE-2021-392226.1Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site ScriptiCVE-2021-392235.3Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 reCVE-2021-392245.3Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbaCVE-2021-392258.1Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 aCVE-2021-392267.3Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snaCVE-2021-392279.8ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper CVE-2021-392289.8Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is CVE-2021-392297.5Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available.CVE-2021-39232.3A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel sCVE-2021-392306.5Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update toCVE-2021-392319.1In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible f
CVE-2021-39220: Low severity, CVSS 3.5 | Vulnix