CVE-2022-36048 - CVE House
Back to Database
Status published Medium CVE-2022-36048

IP address leak via image proxy bypass in Zulip Server

Vulnerability Description

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews [disabled](https://zulip.com/help/allow-image-link-previews) are not affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36048

Credits & Attribution

No credits recorded in the NVD database.

References

More from zulip

View All →
CVE-2025-52559
Zulip XSS in digest preview URL
Medium 6.8
CVE-2025-47930
Zulip Server has access control bypass for restrictions on creation of specific channel types
Medium 5.3
CVE-2025-31478
Zulip Authentication Backend Configuration Bypass
High 8.2
CVE-2025-30369
Zulip allows the deletion of Custom profile fields by administrators of a different organization
Low 2.7
CVE-2025-30368
Zulip allows the deletion of organization by administrators of a different organization
Low 2.7

Affected Vendor

Affected Software

zulip
Vulnerable Versions:
< 5.6

Timeline

Official Publish: August 31st, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-436

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.