CVE-2022-36048

IP address leak via image proxy bypass in Zulip Server

State: Published
Severity: 4.3 Medium
Published: Aug 31, 2022
Updated: Apr 23, 2025
Reserved: Jul 15, 2022

Description

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews [disabled](https://zulip.com/help/allow-image-link-previews) are not affected.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-436 Interpretation Conflict

Affected Products

Product	Versions
zulipzulip	< 5.6Affected

References

https://github.com/zulip/zulip/security/advisories/GHSA-vg5m-mf9x-j452

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.