# NULL CATHEDRAL

> https://nullcathedral.com/
> Generated: 2026-04-10

---


## [Roundcube round two: three more sanitizer bypasses](https://nullcathedral.com/posts/2026-03-18-roundcube-round-two-three-more-sanitizer-bypasses/)

**March 18, 2026**

Three more bypasses in Roundcube's HTML sanitizer: SMIL animation attributes load remote resources, unquoted body backgrounds enable CSS injection, and position:fixed !important enables phishing overlays.

Tags: [vulnerability](https://nullcathedral.com/tags/vulnerability/), [roundcube](https://nullcathedral.com/tags/roundcube/), [svg](https://nullcathedral.com/tags/svg/), [css](https://nullcathedral.com/tags/css/), [email-security](https://nullcathedral.com/tags/email-security/)

---

## [Perfex CRM <=3.4.0 allows unauthenticated RCE via insecure deserialization](https://nullcathedral.com/posts/2026-03-16-perfex-crm-unauthenticated-rce-insecure-deserialization/)

**March 16, 2026**

Perfex CRM passed the autologin cookie into unserialize() without validation, giving unauthenticated attackers remote code execution.

Tags: [vulnerability](https://nullcathedral.com/tags/vulnerability/), [perfex-crm](https://nullcathedral.com/tags/perfex-crm/), [deserialization](https://nullcathedral.com/tags/deserialization/), [rce](https://nullcathedral.com/tags/rce/), [php](https://nullcathedral.com/tags/php/)

---

## [Hello world](https://nullcathedral.com/posts/2026-02-10-hello-world/)

**February 10, 2026**

About this blog and the author behind it.

Tags: [meta](https://nullcathedral.com/tags/meta/)

---

## [Roundcube Webmail <1.5.13 / <1.6.13 allows attackers to force remote image loads via SVG feImage](https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/)

**February 8, 2026**

Roundcube's HTML sanitizer doesn't treat SVG feImage href as an image source. Attackers can bypass remote image blocking to track email opens. (CVE-2026-25916)

Tags: [vulnerability](https://nullcathedral.com/tags/vulnerability/), [roundcube](https://nullcathedral.com/tags/roundcube/), [svg](https://nullcathedral.com/tags/svg/), [email-security](https://nullcathedral.com/tags/email-security/)

---