diff --git a/appinfo/info.xml b/appinfo/info.xml
index 9ab13f49cb..ec6726f493 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -34,7 +34,7 @@ The rating depends on the installed text processing backend. See [the rating ove
 
 Learn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).
 	]]></description>
-	<version>5.8.0-dev.2</version>
+	<version>5.8.0-dev.3</version>
 	<licence>agpl</licence>
 	<author homepage="https://github.com/ChristophWurst">Christoph Wurst</author>
 	<author homepage="https://github.com/GretaD">GretaD</author>
diff --git a/composer.json b/composer.json
index 2a77c697b2..e20d92d22d 100644
--- a/composer.json
+++ b/composer.json
@@ -65,7 +65,7 @@
 	"scripts": {
 		"cs:check": "php-cs-fixer fix --dry-run --diff",
 		"cs:fix": "php-cs-fixer fix",
-		"lint": "find . -name \\*.php -not -path './vendor*/*' -print0 | xargs -0 -n1 php -l",
+		"lint": "find . -name \\*.php -not -path './vendor*/*' -not -path './tests/stubs/*' -print0 | xargs -0 -n1 php -l",
 		"psalm": "psalm.phar",
 		"psalm:fix": "psalm.phar --alter --issues=InvalidReturnType,InvalidNullableReturnType,MismatchingDocblockParamType,MismatchingDocblockReturnType,MissingParamType,InvalidFalsableReturnType",
 		"post-install-cmd": [
diff --git a/lib/Attachment.php b/lib/Attachment.php
index 5912b7e465..5c1d1bb0c8 100644
--- a/lib/Attachment.php
+++ b/lib/Attachment.php
@@ -23,6 +23,8 @@ public function __construct(
 		string $type,
 		string $content,
 		int $size,
+		public readonly ?string $contentId,
+		public readonly ?string $disposition,
 	) {
 		$this->id = $id;
 		$this->name = $name;
@@ -32,12 +34,19 @@ public function __construct(
 	}
 
 	public static function fromMimePart(Horde_Mime_Part $mimePart): self {
+		$disposition = $mimePart->getDisposition();
+		if ($disposition === '') {
+			$disposition = null;
+		}
+
 		return new Attachment(
 			$mimePart->getMimeId(),
 			$mimePart->getName(),
 			$mimePart->getType(),
 			$mimePart->getContents(),
 			(int)$mimePart->getBytes(),
+			$mimePart->getContentId(),
+			$disposition,
 		);
 	}
 
diff --git a/lib/Contracts/IAttachmentService.php b/lib/Contracts/IAttachmentService.php
index 243cdd186a..37e2109692 100644
--- a/lib/Contracts/IAttachmentService.php
+++ b/lib/Contracts/IAttachmentService.php
@@ -12,6 +12,7 @@
 use OCA\Mail\Db\LocalAttachment;
 use OCA\Mail\Exception\AttachmentNotFoundException;
 use OCA\Mail\Service\Attachment\UploadedFile;
+use OCP\Files\SimpleFS\ISimpleFile;
 
 interface IAttachmentService {
 	/**
@@ -22,8 +23,8 @@ public function addFile(string $userId, UploadedFile $file): LocalAttachment;
 	/**
 	 * Try to get an attachment by id
 	 *
+	 * @return array{0: LocalAttachment, 1: ISimpleFile}
 	 * @throws AttachmentNotFoundException
-	 * @return array of LocalAttachment and ISimpleFile
 	 */
 	public function getAttachment(string $userId, int $id): array;
 
diff --git a/lib/Controller/MessagesController.php b/lib/Controller/MessagesController.php
index 84ebc9fab8..f29e63f4e3 100755
--- a/lib/Controller/MessagesController.php
+++ b/lib/Controller/MessagesController.php
@@ -35,6 +35,7 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
 use OCP\AppFramework\Http\ContentSecurityPolicy;
 use OCP\AppFramework\Http\JSONResponse;
@@ -645,9 +646,7 @@ public function getHtmlBody(int $id, bool $plain = false): Response {
 						$mailbox,
 						$message->getUid(),
 						true
-					)->getHtmlBody(
-						$id
-					);
+					)->getHtmlBody($id);
 				} finally {
 					$client->logout();
 				}
diff --git a/lib/Db/LocalAttachment.php b/lib/Db/LocalAttachment.php
index 661ad1823d..8c2e893c77 100644
--- a/lib/Db/LocalAttachment.php
+++ b/lib/Db/LocalAttachment.php
@@ -20,12 +20,20 @@
  * @method void setFileName(string $fileName)
  * @method string getMimeType()
  * @method void setMimeType(string $mimeType)
+ * @method string|null getContentId()
+ * @method void setContentId(?string $contentId)
+ * @method string|null getDisposition()
+ * @method void setDisposition(?string $disposition)
  * @method int|null getCreatedAt()
  * @method void setCreatedAt(int $createdAt)
  * @method int|null getLocalMessageId()
  * @method void setLocalMessageId(int $localMessageId)
  */
 class LocalAttachment extends Entity implements JsonSerializable {
+	public const DISPOSITION_ATTACHMENT = 'attachment';
+	public const DISPOSITION_INLINE = 'inline';
+	public const DISPOSITION_OMIT = null;
+
 	/** @var string */
 	protected $userId;
 
@@ -35,6 +43,12 @@ class LocalAttachment extends Entity implements JsonSerializable {
 	/** @var string */
 	protected $mimeType;
 
+	/** @var ?string */
+	protected $contentId;
+
+	/** @var ?string */
+	protected $disposition;
+
 	/** @var int|null */
 	protected $createdAt;
 
@@ -49,8 +63,14 @@ public function jsonSerialize() {
 			'type' => 'local',
 			'fileName' => $this->fileName,
 			'mimeType' => $this->mimeType,
+			'contentId' => $this->contentId,
+			'disposition' => $this->disposition,
 			'createdAt' => $this->createdAt,
 			'localMessageId' => $this->localMessageId
 		];
 	}
+
+	public function isDispositionAttachmentOrInline(): bool {
+		return $this->disposition === self::DISPOSITION_ATTACHMENT || $this->disposition === self::DISPOSITION_INLINE;
+	}
 }
diff --git a/lib/IMAP/ImapMessageFetcher.php b/lib/IMAP/ImapMessageFetcher.php
index 8ae03cee31..191aba6eb3 100644
--- a/lib/IMAP/ImapMessageFetcher.php
+++ b/lib/IMAP/ImapMessageFetcher.php
@@ -33,6 +33,9 @@
 use function str_starts_with;
 use function strtolower;
 
+/**
+ * @psalm-import-type IMAPAttachment from IMAPMessage
+ */
 class ImapMessageFetcher {
 	/** @var string[] */
 	private array $attachmentsToIgnore = ['signature.asc', 'smime.p7s'];
@@ -50,7 +53,9 @@ class ImapMessageFetcher {
 	private Horde_Imap_Client_Base $client;
 	private string $htmlMessage = '';
 	private string $plainMessage = '';
+	/** @var list<IMAPAttachment> */
 	private array $attachments = [];
+	/** @var list<IMAPAttachment> */
 	private array $inlineAttachments = [];
 	private bool $hasAnyAttachment = false;
 	private array $scheduling = [];
@@ -369,7 +374,8 @@ private function getPart(Horde_Mime_Part $p, string $partNo, bool $isFetched): v
 				'fileName' => $filename,
 				'mime' => $p->getType(),
 				'size' => $p->getBytes(),
-				'cid' => $p->getContentId()
+				'cid' => $p->getContentId(),
+				'disposition' => $p->getDisposition()
 			];
 			return;
 		}
diff --git a/lib/IMAP/MessageMapper.php b/lib/IMAP/MessageMapper.php
index 2602203bc4..67ab76fdd7 100644
--- a/lib/IMAP/MessageMapper.php
+++ b/lib/IMAP/MessageMapper.php
@@ -20,7 +20,7 @@
 use Horde_Imap_Client_Socket;
 use Horde_Mime_Exception;
 use Horde_Mime_Headers;
-use Horde_Mime_Headers_ContentParam;
+use Horde_Mime_Headers_ContentParam_ContentDisposition;
 use Horde_Mime_Headers_ContentParam_ContentType;
 use Horde_Mime_Headers_ContentTransferEncoding;
 use Horde_Mime_Part;
@@ -801,24 +801,15 @@ public function getAttachment(Horde_Imap_Client_Base $client,
 
 		$mimePart = new Horde_Mime_Part();
 
-		// Serve all files with a content-disposition of "attachment" to prevent Cross-Site Scripting
-		$mimePart->setDisposition('attachment');
+		$contentId = $mimeHeaders['content-id']?->value_single;
+		if ($contentId !== null) {
+			$mimePart->setContentId($contentId);
+		}
 
-		// Extract headers from part
-		$cdEl = $mimeHeaders['content-disposition'];
-		$contentDisposition = $cdEl instanceof Horde_Mime_Headers_ContentParam
-			? array_change_key_case($cdEl->params, CASE_LOWER)
-			: null;
-		if (!is_null($contentDisposition) && isset($contentDisposition['filename'])) {
-			$mimePart->setDispositionParameter('filename', $contentDisposition['filename']);
-		} else {
-			$ctEl = $mimeHeaders['content-type'];
-			$contentTypeParams = $ctEl instanceof Horde_Mime_Headers_ContentParam
-				? array_change_key_case($ctEl->params, CASE_LOWER)
-				: null;
-			if (isset($contentTypeParams['name'])) {
-				$mimePart->setContentTypeParameter('name', $contentTypeParams['name']);
-			}
+		$contentDisposition = $mimeHeaders['content-disposition'];
+		if ($contentDisposition instanceof Horde_Mime_Headers_ContentParam_ContentDisposition) {
+			$mimePart->setDisposition($contentDisposition->value_single);
+			$mimePart->setDispositionParameter('filename', $contentDisposition['filename'] ?? null);
 		}
 
 		// Content transfer encoding
@@ -827,17 +818,15 @@ public function getAttachment(Horde_Imap_Client_Base $client,
 			$mimePart->setTransferEncoding($tmp);
 		}
 
-		/* Content type */
-		$contentType = $mimeHeaders['content-type']?->value_single;
-		if (!is_null($contentType) && str_contains($contentType, 'text/calendar')) {
-			$mimePart->setType('text/calendar');
-			if ($mimePart->getContentTypeParameter('name') === null) {
-				$mimePart->setContentTypeParameter('name', 'calendar.ics');
+		$contentType = $mimeHeaders['content-type'];
+		if ($contentType instanceof Horde_Mime_Headers_ContentParam_ContentType) {
+			if (str_contains($contentType->value_single, 'text/calendar')) {
+				$mimePart->setType('text/calendar');
+				$mimePart->setContentTypeParameter('name', $contentType['name'] ?? 'calendar.ics');
+			} else {
+				$mimePart->setType($contentType->value_single);
+				$mimePart->setContentTypeParameter('name', $contentType['name'] ?? null);
 			}
-		} else {
-			// To prevent potential problems with the SOP we serve all files but calendar entries with the
-			// MIME type "application/octet-stream"
-			$mimePart->setType('application/octet-stream');
 		}
 
 		$mimePart->setContents($body);
diff --git a/lib/Migration/Version5008Date20260320125737.php b/lib/Migration/Version5008Date20260320125737.php
new file mode 100644
index 0000000000..c05515b8b9
--- /dev/null
+++ b/lib/Migration/Version5008Date20260320125737.php
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Mail\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\Attributes\ModifyColumn;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+use Override;
+
+/**
+ * @psalm-api
+ */
+#[ModifyColumn(
+	table: 'mail_attachments',
+	description: 'Add column to store content-id and content-disposition', )
+]
+class Version5008Date20260320125737 extends SimpleMigrationStep {
+	/**
+	 * @param Closure(): ISchemaWrapper $schemaClosure
+	 */
+	#[Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		if ($schema->hasTable('mail_attachments')) {
+			$attachmentsTable = $schema->getTable('mail_attachments');
+			$attachmentsTable->addColumn('content_id', Types::STRING, [
+				'notnull' => false,
+			]);
+			$attachmentsTable->addColumn('disposition', Types::STRING, [
+				'notnull' => false,
+			]);
+		}
+
+		return $schema;
+	}
+}
diff --git a/lib/Model/IMAPMessage.php b/lib/Model/IMAPMessage.php
index d4608805bc..040d59c5b7 100644
--- a/lib/Model/IMAPMessage.php
+++ b/lib/Model/IMAPMessage.php
@@ -33,6 +33,16 @@
 
 /**
  * @psalm-import-type MailIMAPFullMessage from ResponseDefinitions
+ *
+ * @psalm-type IMAPAttachment = array{
+ *      id: string|null,
+ *      messageId: int,
+ *      fileName: string|null,
+ *      mime: string,
+ *      size: int,
+ *      cid: string|null,
+ *      disposition: string,
+ *  }
  */
 class IMAPMessage implements IMessage, JsonSerializable {
 	use ConvertAddresses;
@@ -53,6 +63,7 @@ class IMAPMessage implements IMessage, JsonSerializable {
 	public string $plainMessage;
 	public string $htmlMessage;
 	public array $attachments;
+	/** @var list<IMAPAttachment> */
 	public array $inlineAttachments;
 	private bool $hasAttachments;
 	public array $scheduling;
@@ -71,6 +82,9 @@ class IMAPMessage implements IMessage, JsonSerializable {
 	private bool $signatureIsValid;
 	private bool $isPgpMimeEncrypted;
 
+	/**
+	 * @param list<IMAPAttachment> $inlineAttachments
+	 */
 	public function __construct(int $uid,
 		string $messageId,
 		array $flags,
@@ -304,6 +318,7 @@ public function getFullMessage(int $id, bool $loadBody = true): array {
 		if ($this->hasHtmlMessage) {
 			$data['hasHtmlBody'] = true;
 			$data['attachments'] = $this->attachments;
+			$data['inlineAttachments'] = $this->inlineAttachments;
 			return $data;
 		}
 
@@ -349,17 +364,11 @@ public function jsonSerialize() {
 	 * @return string
 	 */
 	public function getHtmlBody(int $id): string {
-		return $this->htmlService->sanitizeHtmlMailBody($this->htmlMessage, [
-			'id' => $id,
-		], function ($cid) {
-			$match = array_filter($this->inlineAttachments,
-				static fn ($a) => $a['cid'] === $cid);
-			$match = array_shift($match);
-			if ($match === null) {
-				return null;
-			}
-			return $match['id'];
-		});
+		return $this->htmlService->sanitizeHtmlMailBody(
+			$id,
+			$this->htmlMessage,
+			$this->inlineAttachments,
+		);
 	}
 
 	/**
diff --git a/lib/Provider/Command/MessageSend.php b/lib/Provider/Command/MessageSend.php
index 801db70d3b..bad5ea7dd4 100644
--- a/lib/Provider/Command/MessageSend.php
+++ b/lib/Provider/Command/MessageSend.php
@@ -91,11 +91,29 @@ public function perform(string $userId, string $serviceId, IMessage $message, ar
 		$attachments = [];
 		try {
 			foreach ($message->getAttachments() as $entry) {
+				/*
+				 * The mail provider API has no disposition field, so we infer it:
+				 * omit the Content-Disposition header (null) when name is null,
+				 * otherwise default to attachment.
+				 *
+				 * See https://github.com/nextcloud/mail/issues/10416 for the original motivation.
+				 *
+				 * Previously handled in TransmissionService::handleAttachment;
+				 * moved here now that LocalAttachment carries a disposition field.
+				 */
+				if ($entry->getName() === null) {
+					$disposition = LocalAttachment::DISPOSITION_OMIT;
+				} else {
+					$disposition = LocalAttachment::DISPOSITION_ATTACHMENT;
+				}
+
 				$attachments[] = $this->attachmentService->addFileFromString(
 					$userId,
 					(string)$entry->getName(),
 					(string)$entry->getType(),
-					(string)$entry->getContents()
+					(string)$entry->getContents(),
+					null,
+					$disposition,
 				);
 			}
 		} catch (UploadException $e) {
diff --git a/lib/Service/AntiSpamService.php b/lib/Service/AntiSpamService.php
index d991f036c9..464edbc9ab 100644
--- a/lib/Service/AntiSpamService.php
+++ b/lib/Service/AntiSpamService.php
@@ -157,10 +157,12 @@ public function sendReportEmail(Account $account, Mailbox $mailbox, int $uid, st
 		$mimeMessage = new MimeMessage(
 			new DataUriParser()
 		);
+
 		$mimePart = $mimeMessage->build(
 			null,
 			$message->getContent(),
-			$message->getAttachments()
+			false,
+			array_values($message->getAttachments()),
 		);
 
 		$mail->setBasePart($mimePart);
diff --git a/lib/Service/Attachment/AttachmentService.php b/lib/Service/Attachment/AttachmentService.php
index 2716101d3e..4706442474 100644
--- a/lib/Service/Attachment/AttachmentService.php
+++ b/lib/Service/Attachment/AttachmentService.php
@@ -32,6 +32,7 @@
 use OCP\Files\IMimeTypeDetector;
 use OCP\Files\NotFoundException;
 use OCP\Files\NotPermittedException;
+use OCP\Files\SimpleFS\ISimpleFile;
 use OCP\ICacheFactory;
 use OCP\IURLGenerator;
 use Psr\Log\LoggerInterface;
@@ -94,6 +95,8 @@ public function addFile(string $userId, UploadedFile $file): LocalAttachment {
 		$attachment->setUserId($userId);
 		$attachment->setFileName($file->getFileName());
 		$attachment->setMimeType($file->getMimeType());
+		$attachment->setContentId(null);
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_ATTACHMENT);
 		$attachment->setCreatedAt($this->timeFactory->getTime());
 
 		$persisted = $this->mapper->insert($attachment);
@@ -108,11 +111,21 @@ public function addFile(string $userId, UploadedFile $file): LocalAttachment {
 		return $attachment;
 	}
 
-	public function addFileFromString(string $userId, string $name, string $mime, string $fileContents): LocalAttachment {
+	public function addFileFromString(
+		string $userId,
+		string $name,
+		string $mime,
+		string $fileContents,
+		?string $contentId,
+		?string $disposition,
+
+	): LocalAttachment {
 		$attachment = new LocalAttachment();
 		$attachment->setUserId($userId);
 		$attachment->setFileName($name);
 		$attachment->setMimeType($mime);
+		$attachment->setContentId($contentId);
+		$attachment->setDisposition($disposition);
 		$attachment->setCreatedAt($this->timeFactory->getTime());
 
 		$persisted = $this->mapper->insert($attachment);
@@ -128,11 +141,9 @@ public function addFileFromString(string $userId, string $name, string $mime, st
 	}
 
 	/**
-	 * @param string $userId
-	 * @param int $id
-	 *
-	 * @return array of LocalAttachment and ISimpleFile
+	 * Try to get an attachment by id
 	 *
+	 * @return array{0: LocalAttachment, 1: ISimpleFile}
 	 * @throws AttachmentNotFoundException
 	 */
 	#[\Override]
@@ -252,7 +263,7 @@ public function handleAttachments(Account $account, array $attachments, \Horde_I
 				$attachmentIds[] = $this->handleForwardedMessageAttachment($account, $attachment, $client);
 				continue;
 			}
-			if ($attachment['type'] === 'message-attachment') {
+			if ($attachment['type'] === 'message-attachment' || $attachment['type'] === 'message-attachment-inline') {
 				// Adds an attachment from another email (use case is, eg., a mail forward)
 				$attachmentIds[] = $this->handleForwardedAttachment($account, $attachment, $client);
 				continue;
@@ -345,7 +356,7 @@ private function handleForwardedMessageAttachment(Account $account, array $attac
 		}
 
 		try {
-			$localAttachment = $this->addFileFromString($account->getUserId(), $attachment['fileName'] ?? $attachmentMessage->getSubject() . '.eml', $mime, $fullText);
+			$localAttachment = $this->addFileFromString($account->getUserId(), $attachment['fileName'] ?? $attachmentMessage->getSubject() . '.eml', $mime, $fullText, null, null);
 		} catch (UploadException $e) {
 			$this->logger->error('Could not create attachment', ['exception' => $e]);
 			return null;
@@ -365,32 +376,23 @@ private function handleForwardedMessageAttachment(Account $account, array $attac
 	private function handleForwardedAttachment(Account $account, array $attachment, \Horde_Imap_Client_Socket $client): ?int {
 		$mailbox = $this->mailManager->getMailbox($account->getUserId(), $attachment['mailboxId']);
 
-		$attachments = $this->messageMapper->getRawAttachments(
+		$imapAttachment = $this->messageMapper->getAttachment(
 			$client,
 			$mailbox->getName(),
 			(int)$attachment['uid'],
+			$attachment['id'],
 			$account->getUserId(),
-			[
-				$attachment['id'] ?? []
-			]
 		);
 
-		if ($attachments === []) {
-			return null;
-		}
-
-		// detect mime type
-		$mime = 'application/octet-stream';
-		if (extension_loaded('fileinfo')) {
-			$finfo = new finfo(FILEINFO_MIME_TYPE);
-			$detectedMime = $finfo->buffer($attachments[0]);
-			if ($detectedMime !== false) {
-				$mime = $detectedMime;
-			}
-		}
-
 		try {
-			$localAttachment = $this->addFileFromString($account->getUserId(), $attachment['fileName'], $mime, $attachments[0]);
+			$localAttachment = $this->addFileFromString(
+				$account->getUserId(),
+				$imapAttachment->getName() ?? 'unknown',
+				$imapAttachment->getType(),
+				$imapAttachment->getContent(),
+				$imapAttachment->contentId,
+				$imapAttachment->disposition,
+			);
 		} catch (UploadException $e) {
 			$this->logger->error('Could not create attachment', ['exception' => $e]);
 			return null;
@@ -439,7 +441,7 @@ private function handleCloudAttachment(Account $account, array $attachment): ?in
 		}
 
 		try {
-			$localAttachment = $this->addFileFromString($account->getUserId(), $file->getName(), $file->getMimeType(), $file->getContent());
+			$localAttachment = $this->addFileFromString($account->getUserId(), $file->getName(), $file->getMimeType(), $file->getContent(), null, null);
 		} catch (UploadException $e) {
 			$this->logger->error('Could not create attachment', ['exception' => $e]);
 			return null;
diff --git a/lib/Service/DataUri/DataUri.php b/lib/Service/DataUri/DataUri.php
index 0bda5ec072..1bcf6799a9 100644
--- a/lib/Service/DataUri/DataUri.php
+++ b/lib/Service/DataUri/DataUri.php
@@ -10,16 +10,16 @@
 namespace OCA\Mail\Service\DataUri;
 
 final class DataUri {
-	private string $mediaType;
-	private array $parameters;
-	private bool $base64;
-	private string $data;
-
-	public function __construct(string $mediaType, array $parameters, bool $base64, $data) {
-		$this->mediaType = $mediaType;
-		$this->parameters = $parameters;
-		$this->base64 = $base64;
-		$this->data = $data;
+
+	/**
+	 * @param array{charset: string, ...} $parameters
+	 */
+	public function __construct(
+		private readonly string $mediaType,
+		private readonly array $parameters,
+		private readonly bool $base64,
+		private readonly string $data,
+	) {
 	}
 
 	public function getMediaType(): string {
diff --git a/lib/Service/Html.php b/lib/Service/Html.php
index fd6c0cf087..e5524df941 100755
--- a/lib/Service/Html.php
+++ b/lib/Service/Html.php
@@ -10,13 +10,14 @@
 
 namespace OCA\Mail\Service;
 
-use Closure;
 use HTMLPurifier;
 use HTMLPurifier_Config;
 use HTMLPurifier_HTMLDefinition;
 use HTMLPurifier_URIDefinition;
 use HTMLPurifier_URISchemeRegistry;
+use OCA\Mail\Model\IMAPMessage;
 use OCA\Mail\Service\HtmlPurify\CidURIScheme;
+use OCA\Mail\Service\HtmlPurify\TransformCidDataAttr;
 use OCA\Mail\Service\HtmlPurify\TransformHTMLLinks;
 use OCA\Mail\Service\HtmlPurify\TransformImageSrc;
 use OCA\Mail\Service\HtmlPurify\TransformNoReferrer;
@@ -33,6 +34,9 @@
 
 require_once __DIR__ . '/../../vendor/cerdic/css-tidy/class.csstidy.php';
 
+/**
+ * @psalm-import-type IMAPAttachment from IMAPMessage
+ */
 class Html {
 	/** @var IURLGenerator */
 	private $urlGenerator;
@@ -73,9 +77,9 @@ public function convertLinks(string $data): string {
 		// TODO: Fix this - requires https://github.com/owncloud/core/issues/10767 to be fixed
 		$config->set('Cache.DefinitionImpl', null);
 
-		/** @var HTMLPurifier_HTMLDefinition $uri */
-		$uri = $config->getDefinition('HTML');
-		$uri->info_attr_transform_post['noreferrer'] = new TransformNoReferrer();
+		/** @var HTMLPurifier_HTMLDefinition $def */
+		$def = $config->getHTMLDefinition(true);
+		$def->info_attr_transform_post['noreferrer'] = new TransformNoReferrer();
 
 		$purifier = new HTMLPurifier($config);
 
@@ -102,7 +106,28 @@ public function parseMailBody(string $body): array {
 		];
 	}
 
-	public function sanitizeHtmlMailBody(string $mailBody, array $messageParameters, Closure $mapCidToAttachmentId): string {
+	/**
+	 * @param list<IMAPAttachment> $inlineAttachments
+	 * @return list<array{id: string|null, messageId: int, fileName: string|null, mime: string, size: int, cid: string|null, disposition: string, url: string}>
+	 */
+	private function addAttachmentUrl(int $messageId, array $inlineAttachments): array {
+		return array_map(function (array $inlineAttachment) use ($messageId) {
+			$inlineAttachment['url'] = $this->urlGenerator->linkToRouteAbsolute(
+				'mail.messages.downloadAttachment', [
+					'id' => $messageId,
+					'attachmentId' => $inlineAttachment['id']
+				]
+			);
+			return $inlineAttachment;
+		}, $inlineAttachments);
+	}
+
+	/**
+	 * @param list<IMAPAttachment> $inlineAttachments
+	 */
+	public function sanitizeHtmlMailBody(int $messageId, string $mailBody, array $inlineAttachments): string {
+		$inlineAttachments = $this->addAttachmentUrl($messageId, $inlineAttachments);
+
 		$config = HTMLPurifier_Config::createDefault();
 
 		// Append target="_blank" to all link (a) elements
@@ -122,15 +147,18 @@ public function sanitizeHtmlMailBody(string $mailBody, array $messageParameters,
 		$config->set('Cache.DefinitionImpl', null);
 
 		// Rewrite URL for redirection and proxying of content
-		/** @var HTMLPurifier_HTMLDefinition $html */
-		$html = $config->getDefinition('HTML');
-		$html->info_attr_transform_post['imagesrc'] = new TransformImageSrc($this->urlGenerator);
-		$html->info_attr_transform_post['cssbackground'] = new TransformStyleURLs($this->urlGenerator);
-		$html->info_attr_transform_post['htmllinks'] = new TransformHTMLLinks();
+		/** @var HTMLPurifier_HTMLDefinition $def */
+		$def = $config->getHTMLDefinition(true);
+		$def->info_attr_transform_post['imagesrc'] = new TransformImageSrc($this->urlGenerator);
+		$def->info_attr_transform_post['cssbackground'] = new TransformStyleURLs($this->urlGenerator);
+		$def->info_attr_transform_post['htmllinks'] = new TransformHTMLLinks();
+		if (count($inlineAttachments) > 0) {
+			$def->info_attr_transform_post['datacid'] = new TransformCidDataAttr($inlineAttachments);
+		}
 
 		/** @var HTMLPurifier_URIDefinition $uri */
-		$uri = $config->getDefinition('URI');
-		$uri->addFilter(new TransformURLScheme($messageParameters, $mapCidToAttachmentId, $this->urlGenerator, $this->request), $config);
+		$uri = $config->getURIDefinition(true);
+		$uri->addFilter(new TransformURLScheme($inlineAttachments, $this->urlGenerator, $this->request), $config);
 
 		$uriSchemeRegistry = HTMLPurifier_URISchemeRegistry::instance();
 		$uriSchemeRegistry->register('cid', new CidURIScheme());
diff --git a/lib/Service/HtmlPurify/TransformCidDataAttr.php b/lib/Service/HtmlPurify/TransformCidDataAttr.php
new file mode 100644
index 0000000000..bfe5083e64
--- /dev/null
+++ b/lib/Service/HtmlPurify/TransformCidDataAttr.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Mail\Service\HtmlPurify;
+
+use HTMLPurifier_AttrTransform;
+use HTMLPurifier_Config;
+use HTMLPurifier_Context;
+use HTMLPurifier_URIParser;
+
+/**
+ * Sets data-cid on inline image elements after their cid: src has been replaced
+ * with an attachment URL, so the MIME builder can reconstruct inline attachments
+ * when the message is forwarded.
+ */
+class TransformCidDataAttr extends HTMLPurifier_AttrTransform {
+	private HTMLPurifier_URIParser $parser;
+	/** @var array<string, string> path => cid */
+	private array $pathToCid;
+
+	public function __construct(array $inlineAttachments) {
+		$this->parser = new HTMLPurifier_URIParser();
+		$this->pathToCid = [];
+		foreach ($inlineAttachments as $inlineAttachment) {
+			if (isset($inlineAttachment['cid'], $inlineAttachment['url'])) {
+				$url = $this->parser->parse($inlineAttachment['url']);
+				$this->pathToCid[$url->path] = $inlineAttachment['cid'];
+			}
+		}
+	}
+
+	/**
+	 * @param array $attr
+	 * @param HTMLPurifier_Config $config
+	 * @param HTMLPurifier_Context $context
+	 * @return array
+	 */
+	#[\Override]
+	public function transform($attr, $config, $context) {
+		if ($context->get('CurrentToken')->name !== 'img' || !isset($attr['src'])) {
+			return $attr;
+		}
+
+		$url = $this->parser->parse($attr['src']);
+		$cid = $this->pathToCid[$url->path] ?? null;
+
+		if ($cid !== null) {
+			$attr['data-cid'] = $cid;
+		}
+
+		return $attr;
+	}
+}
diff --git a/lib/Service/HtmlPurify/TransformURLScheme.php b/lib/Service/HtmlPurify/TransformURLScheme.php
index 61bab3eaed..44c001c134 100644
--- a/lib/Service/HtmlPurify/TransformURLScheme.php
+++ b/lib/Service/HtmlPurify/TransformURLScheme.php
@@ -10,8 +10,8 @@
 
 namespace OCA\Mail\Service\HtmlPurify;
 
-use Closure;
 use HTMLPurifier_Config;
+use HTMLPurifier_Context;
 use HTMLPurifier_URI;
 use HTMLPurifier_URIFilter;
 use HTMLPurifier_URIParser;
@@ -19,31 +19,13 @@
 use OCP\IURLGenerator;
 
 class TransformURLScheme extends HTMLPurifier_URIFilter {
-	public $name = 'TransformURLScheme';
-	public $post = true;
-
-	/** @var IURLGenerator */
-	private $urlGenerator;
-
-	/** @var IRequest */
-	private $request;
-
-	/**
-	 * @var \Closure
-	 */
-	private $mapCidToAttachmentId;
-
-	/** @var array */
-	private $messageParameters;
-
-	public function __construct(array $messageParameters,
-		Closure $mapCidToAttachmentId,
-		IURLGenerator $urlGenerator,
-		IRequest $request) {
-		$this->messageParameters = $messageParameters;
-		$this->mapCidToAttachmentId = $mapCidToAttachmentId;
-		$this->urlGenerator = $urlGenerator;
-		$this->request = $request;
+	public function __construct(
+		private array $inlineAttachments,
+		private IURLGenerator $urlGenerator,
+		private IRequest $request,
+	) {
+		$this->name = 'TransformURLScheme';
+		$this->post = true;
 	}
 
 	/**
@@ -51,7 +33,7 @@ public function __construct(array $messageParameters,
 	 *
 	 * @param \HTMLPurifier_URI $uri
 	 * @param HTMLPurifier_Config $config
-	 * @param \HTMLPurifier_Context $context
+	 * @param HTMLPurifier_Context $context
 	 * @return bool
 	 */
 	#[\Override]
@@ -67,27 +49,13 @@ public function filter(&$uri, $config, $context) {
 		}
 
 		if ($uri->scheme === 'cid') {
-			$attachmentId = $this->mapCidToAttachmentId->__invoke($uri->path);
-			if (is_null($attachmentId)) {
-				return true;
-			}
-			$this->messageParameters['attachmentId'] = $attachmentId;
-
-			$imgUrl = $this->urlGenerator->linkToRouteAbsolute('mail.messages.downloadAttachment',
-				$this->messageParameters);
-			$parser = new HTMLPurifier_URIParser();
-			$uri = $parser->parse($imgUrl);
+			$uri = $this->replaceCidWithUrl($uri);
 		}
 
 		return true;
 	}
 
-	/**
-	 * @param HTMLPurifier_URI $uri
-	 * @param \HTMLPurifier_Context $context
-	 * @return HTMLPurifier_URI
-	 */
-	private function filterHttpFtp(&$uri, $context) {
+	private function filterHttpFtp(HTMLPurifier_URI $uri, HTMLPurifier_Context $context): HTMLPurifier_URI {
 		$originalURL = urlencode($uri->scheme . '://' . $uri->host);
 
 		// Add the port if it's not a default port
@@ -125,4 +93,16 @@ private function filterHttpFtp(&$uri, $context) {
 			null
 		);
 	}
+
+	private function replaceCidWithUrl(HTMLPurifier_URI $uri): HTMLPurifier_URI {
+		$inlineAttachment = array_find($this->inlineAttachments, static function ($attachment) use ($uri) {
+			return $attachment['cid'] === $uri->path;
+		});
+
+		if ($inlineAttachment === null) {
+			return $uri;
+		}
+
+		return (new HTMLPurifier_URIParser())->parse($inlineAttachment['url']);
+	}
 }
diff --git a/lib/Service/MailTransmission.php b/lib/Service/MailTransmission.php
index be808fc6fb..eed9ed8b6f 100644
--- a/lib/Service/MailTransmission.php
+++ b/lib/Service/MailTransmission.php
@@ -137,8 +137,8 @@ public function sendMessage(Account $account, LocalMessage $localMessage): void
 		$mimePart = $mimeMessage->build(
 			$localMessage->getBodyPlain(),
 			$localMessage->getBodyHtml(),
+			$localMessage->isPgpMime() === true,
 			$attachmentParts,
-			$localMessage->isPgpMime() === true
 		);
 
 		// TODO: add smimeEncrypt check if implemented
diff --git a/lib/Service/MimeMessage.php b/lib/Service/MimeMessage.php
index 57873b0f18..1188d18500 100644
--- a/lib/Service/MimeMessage.php
+++ b/lib/Service/MimeMessage.php
@@ -26,15 +26,19 @@ public function __construct(DataUriParser $uriParser) {
 	}
 
 	/**
-	 * generates mime message
+	 * Generates mime message
 	 *
-	 * @param string $contentPlain
-	 * @param string $contentHtml
-	 * @param Horde_Mime_Part[] $attachments
+	 * @param list<Horde_Mime_Part> $attachments
 	 *
 	 * @return Horde_Mime_Part
 	 */
-	public function build(?string $contentPlain, ?string $contentHtml, array $attachments, bool $isPgpEncrypted = false): Horde_Mime_Part {
+	public function build(
+		?string $contentPlain,
+		?string $contentHtml,
+		bool $isPgpEncrypted,
+		array $attachments,
+	): Horde_Mime_Part {
+		[$inlineAttachments, $attachments] = $this->separateAttachments($attachments);
 
 		if ($isPgpEncrypted === true && isset($contentPlain)) {
 			$basePart = $this->buildPgpPart($contentPlain);
@@ -44,12 +48,12 @@ public function build(?string $contentPlain, ?string $contentHtml, array $attach
 			*/
 			$basePart = new Horde_Mime_Part();
 			$basePart->setType('multipart/mixed');
-			$basePart[] = $this->buildMessagePart($contentPlain, $contentHtml);
+			$basePart[] = $this->buildMessagePart($contentPlain, $contentHtml, $inlineAttachments);
 			foreach ($attachments as $attachment) {
 				$basePart[] = $attachment;
 			}
 		} else {
-			$basePart = $this->buildMessagePart($contentPlain, $contentHtml);
+			$basePart = $this->buildMessagePart($contentPlain, $contentHtml, $inlineAttachments);
 		}
 
 		$basePart->isBasePart(true);
@@ -60,9 +64,11 @@ public function build(?string $contentPlain, ?string $contentHtml, array $attach
 	/**
 	 * generates html/plain message part
 	 *
+	 * @param list<Horde_Mime_Part> $inlineAttachments
+	 *
 	 * @return Horde_Mime_Part
 	 */
-	private function buildMessagePart(?string $contentPlain, ?string $contentHtml): Horde_Mime_Part {
+	private function buildMessagePart(?string $contentPlain, ?string $contentHtml, array $inlineAttachments): Horde_Mime_Part {
 
 		if (isset($contentHtml)) {
 
@@ -73,39 +79,9 @@ private function buildMessagePart(?string $contentPlain, ?string $contentHtml):
 				$source = ' ' . $contentHtml;
 			}
 
-			// determine if content has any embedded images
-			$embeddedParts = [];
 			$doc = Parser::parseToDomDocument($source);
-			foreach ($doc->getElementsByTagName('img') as $id => $image) {
-				if (!($image instanceof DOMElement)) {
-					continue;
-				}
-
-				$src = $image->getAttribute('src');
-				if ($src === '') {
-					continue;
-				}
-				try {
-					$dataUri = $this->uriParser->parse($src);
-				} catch (InvalidDataUriException $e) {
-					continue;
-				}
-
-				$part = new Horde_Mime_Part();
-				$part->setType($dataUri->getMediaType());
-				$part->setCharset($dataUri->getParameters()['charset']);
-				$part->setName('embedded_image_' . $id);
-				$part->setDisposition('inline');
-				if ($dataUri->isBase64()) {
-					$part->setTransferEncoding('base64');
-				}
-				$part->setContents($dataUri->getData());
-
-				$cid = $part->setContentId();
-				$embeddedParts[] = $part;
-
-				$image->setAttribute('src', 'cid:' . $cid);
-			}
+			array_push($inlineAttachments, ...$this->extractDataUriImages($doc));
+			$this->rewriteSrcToCid($doc);
 			$htmlContent = $doc->saveHTML();
 
 			$htmlPart = new Horde_Mime_Part();
@@ -145,14 +121,14 @@ private function buildMessagePart(?string $contentPlain, ?string $contentHtml):
 			$messagePart = new Horde_Mime_Part();
 		}
 
-		if (isset($embeddedParts) && count($embeddedParts) > 0) {
+		if (count($inlineAttachments) > 0) {
 			/*
 			 * Text parts with embedded content (e.g. inline images, etc) need be wrapped in multipart/related part
 			 */
 			$basePart = new Horde_Mime_Part();
 			$basePart->setType('multipart/related');
 			$basePart[] = $messagePart;
-			foreach ($embeddedParts as $part) {
+			foreach ($inlineAttachments as $part) {
 				$basePart[] = $part;
 			}
 		} else {
@@ -162,6 +138,74 @@ private function buildMessagePart(?string $contentPlain, ?string $contentHtml):
 		return $basePart;
 	}
 
+	/**
+	 * Extracts data URI images from the HTML document, converts each to an
+	 * inline MIME part with a generated Content-ID, and rewrites the src
+	 * attribute to the corresponding cid: reference.
+	 *
+	 * @return Horde_Mime_Part[]
+	 */
+	private function extractDataUriImages(DOMDocument $doc): array {
+		$parts = [];
+		foreach ($doc->getElementsByTagName('img') as $id => $image) {
+			if (!($image instanceof DOMElement)) {
+				continue;
+			}
+
+			$src = $image->getAttribute('src');
+			if ($src === '') {
+				continue;
+			}
+
+			try {
+				$dataUri = $this->uriParser->parse($src);
+			} catch (InvalidDataUriException) {
+				continue;
+			}
+
+			if (!str_starts_with($dataUri->getMediaType(), 'image/')) {
+				continue;
+			}
+
+			$part = new Horde_Mime_Part();
+			$part->setType($dataUri->getMediaType());
+			$part->setCharset($dataUri->getParameters()['charset']);
+			$part->setName('embedded_image_' . $id);
+			$part->setDisposition('inline');
+			if ($dataUri->isBase64()) {
+				$part->setTransferEncoding('base64');
+			}
+			$part->setContents($dataUri->getData());
+
+			$cid = $part->setContentId();
+			$parts[] = $part;
+
+			$image->setAttribute('src', 'cid:' . $cid);
+		}
+		return $parts;
+	}
+
+	/**
+	 * Rewrites src attributes of img elements that carry a data-cid attribute
+	 * back to their cid: reference, as required by the MIME structure for
+	 * inline attachments when forwarding messages.
+	 */
+	private function rewriteSrcToCid(DOMDocument $doc): void {
+		foreach ($doc->getElementsByTagName('img') as $image) {
+			if (!($image instanceof DOMElement)) {
+				continue;
+			}
+
+			$cid = $image->getAttribute('data-cid');
+			if ($cid === '') {
+				continue;
+			}
+
+			$image->setAttribute('src', 'cid:' . $cid);
+			$image->removeAttribute('data-cid');
+		}
+	}
+
 	/**
 	 * generates pgp encrypted message part
 	 *
@@ -196,6 +240,25 @@ private function buildPgpPart(string $content): Horde_Mime_Part {
 
 	}
 
+	/**
+	 * @param list<Horde_Mime_Part> $attachments
+	 * @return array{0: list<Horde_Mime_Part>, 1: list<Horde_Mime_Part>}
+	 */
+	private function separateAttachments(array $attachments): array {
+		$inline = [];
+		$normal = [];
+
+		foreach ($attachments as $attachment) {
+			if ($attachment->getDisposition() === 'inline') {
+				$inline[] = $attachment;
+			} else {
+				$normal[] = $attachment;
+			}
+		}
+
+		return [$inline, $normal];
+	}
+
 	/**
 	 * A callback for Horde_Text_Filter.
 	 *
diff --git a/lib/Service/TransmissionService.php b/lib/Service/TransmissionService.php
index ce8e1ca459..af3ac3c4a4 100644
--- a/lib/Service/TransmissionService.php
+++ b/lib/Service/TransmissionService.php
@@ -75,10 +75,20 @@ public function handleAttachment(Account $account, array $attachment): ?Horde_Mi
 			[$localAttachment, $file] = $this->attachmentService->getAttachment($account->getMailAccount()->getUserId(), (int)$attachment['id']);
 			$part = new Horde_Mime_Part();
 			$part->setCharset('us-ascii');
-			if (!empty($localAttachment->getFileName())) {
-				$part->setDisposition('attachment');
+
+			if ($localAttachment->isDispositionAttachmentOrInline()) {
+				$part->setDisposition($localAttachment->getDisposition());
+				/*
+				 * Setting a name implicitly adds a Content-Disposition header in Horde,
+				 * which would override the intentional omission. Only set it for attachment/inline dispositions.
+				 */
 				$part->setName($localAttachment->getFileName());
 			}
+
+			if ($localAttachment->getContentId() !== null) {
+				$part->setContentId($localAttachment->getContentId());
+			}
+
 			$part->setContents($file->getContent());
 			/*
 			 * Horde_Mime_Part.setType takes the mimetype (e.g. text/calendar)
diff --git a/psalm.xml b/psalm.xml
index 2d07575f04..b2d115ea6d 100644
--- a/psalm.xml
+++ b/psalm.xml
@@ -24,6 +24,9 @@
 		<directory name="lib/Vendor" />
 		<directory name="vendor-bin/psalm-stubs" />
     </extraFiles>
+	<stubs>
+		<file name="tests/stubs/php-polyfill.php" />
+	</stubs>
 	<issueHandlers>
 		<UndefinedAttributeClass>
 			<errorLevel type="info">
@@ -68,10 +71,5 @@
 				<referencedClass name="Symfony\Component\Console\Output\OutputInterface" />
 			</errorLevel>
 		</UndefinedDocblockClass>
-		<UndefinedFunction>
-			<errorLevel type="suppress">
-				<referencedFunction name="str_contains" />
-			</errorLevel>
-		</UndefinedFunction>
 	</issueHandlers>
 </psalm>
diff --git a/src/components/ComposerAttachment.vue b/src/components/ComposerAttachment.vue
index bb5f8a9abc..14b3cb27a2 100644
--- a/src/components/ComposerAttachment.vue
+++ b/src/components/ComposerAttachment.vue
@@ -5,9 +5,7 @@
 <template>
 	<li class="composer-attachment" :class="{ 'composer-attachment--with-error': attachment.error }">
 		<div class="attachment-preview">
-			<img v-if="attachment.imageBlobURL !== false" :src="attachment.imageBlobURL" class="attachment-preview-image">
-			<img v-else-if="attachment.hasPreview" :src="previewURL" class="attachment-preview-image">
-			<img v-else :src="getIcon" class="attachment-preview-image">
+			<img :src="previewSrc" class="attachment-preview-image">
 			<span v-if="attachment.type === 'cloud'" class="cloud-attachment-icon">
 				<Cloud :size="20" />
 			</span>
@@ -67,14 +65,25 @@ export default {
 	},
 
 	computed: {
-		previewURL() {
-			if (this.attachment.hasPreview && this.attachment.id > 0) {
+		previewSrc() {
+			// uploaded attachment
+			if (this.attachment.type === 'local' && this.attachment.imageBlobURL !== false) {
+				return this.attachment.imageBlobURL
+			}
+
+			// attachment from cloud
+			if (this.attachment.type === 'cloud' && this.attachment.hasPreview && this.attachment.id > 0) {
 				return generateUrl(`/core/preview?fileId=${this.attachment.id}&x=100&y=100&a=0`)
 			}
-			return ''
-		},
 
-		getIcon() {
+			// embedded image when forwarding a message
+			if (this.attachment.type === 'message-attachment-inline' && this.attachment.databaseId) {
+				return generateUrl('/apps/mail/api/messages/{id}/attachment/{attachmentId}', {
+					id: this.attachment.databaseId,
+					attachmentId: this.attachment.id,
+				})
+			}
+
 			return OC.MimeType.getIconUrl(this.attachment.fileType)
 		},
 
diff --git a/src/components/ComposerAttachments.vue b/src/components/ComposerAttachments.vue
index a885a093e8..a375427c3d 100644
--- a/src/components/ComposerAttachments.vue
+++ b/src/components/ComposerAttachments.vue
@@ -199,6 +199,8 @@ export default {
 				finished: true,
 				sizeString: this.formatBytes(attachment.size),
 				imageBlobURL: attachment.isImage ? attachment.downloadUrl : attachment.mimeUrl,
+				type: attachment.type,
+				databaseId: attachment?.databaseId,
 			})
 			return attachment
 		})
@@ -281,6 +283,7 @@ export default {
 					finished: false,
 					error: false,
 					hasPreview: false,
+					type: 'local',
 					controller,
 				}
 				this.attachments.push(attachment)
diff --git a/src/components/TextEditor.vue b/src/components/TextEditor.vue
index 82908cf751..bf0ab933a4 100644
--- a/src/components/TextEditor.vue
+++ b/src/components/TextEditor.vue
@@ -212,6 +212,17 @@ export default {
 						},
 					],
 				},
+
+				htmlSupport: {
+					allow: [
+						{
+							name: 'img',
+							attributes: {
+								'data-cid': true,
+							},
+						},
+					],
+				},
 			},
 		}
 	},
diff --git a/src/store/mainStore/actions.js b/src/store/mainStore/actions.js
index 687eb16b0e..97e8db8881 100644
--- a/src/store/mainStore/actions.js
+++ b/src/store/mainStore/actions.js
@@ -61,7 +61,10 @@ import {
 } from '../../service/caldavService.js'
 import { moveDraft, updateDraft } from '../../service/DraftService.js'
 import * as FollowUpService from '../../service/FollowUpService.js'
-import { addInternalAddress, removeInternalAddress } from '../../service/InternalAddressService.js'
+import {
+	addInternalAddress,
+	removeInternalAddress,
+} from '../../service/InternalAddressService.js'
 import {
 	clearMailbox,
 	create as createMailbox,
@@ -92,14 +95,25 @@ import {
 } from '../../service/MessageService.js'
 import { showNewMessagesNotification } from '../../service/NotificationService.js'
 import { savePreference } from '../../service/PreferenceService.js'
-import { createQuickAction, deleteQuickAction, updateQuickAction } from '../../service/QuickActionsService.js'
+import {
+	createQuickAction,
+	deleteQuickAction,
+	updateQuickAction,
+} from '../../service/QuickActionsService.js'
 import {
 	getActiveScript,
 	updateActiveScript,
 	updateAccount as updateSieveAccount,
 } from '../../service/SieveService.js'
-import * as SmimeCertificateService from '../../service/SmimeCertificateService.js'
-import { createTextBlock, deleteTextBlock, fetchMyTextBlocks, fetchSharedTextBlocks, updateTextBlock } from '../../service/TextBlockService.js'
+import * as SmimeCertificateService
+	from '../../service/SmimeCertificateService.js'
+import {
+	createTextBlock,
+	deleteTextBlock,
+	fetchMyTextBlocks,
+	fetchSharedTextBlocks,
+	updateTextBlock,
+} from '../../service/TextBlockService.js'
 import * as ThreadService from '../../service/ThreadService.js'
 import { normalizedEnvelopeListId } from '../../util/normalization.js'
 import {
@@ -558,13 +572,7 @@ export default function mainStoreActions() {
 								bodyHtml: data.bodyHtml,
 								bodyPlain: data.bodyPlain,
 								forwardFrom: reply.data,
-								attachments: original.attachments.map((attachment) => ({
-									...attachment,
-									mailboxId: original.mailboxId,
-									// messageId for attachments is actually the uid
-									uid: attachment.messageId,
-									type: 'message-attachment',
-								})),
+								attachments: this.prepareAttachments(original),
 							},
 						})
 						return
@@ -614,6 +622,37 @@ export default function mainStoreActions() {
 				}
 			})
 		},
+		prepareAttachments(original) {
+			const attachments = []
+
+			if (original.attachments) {
+				for (const attachment of original.attachments) {
+					attachments.push({
+						...attachment,
+						databaseId: original.databaseId,
+						mailboxId: original.mailboxId,
+						// messageId for attachments is actually the uid
+						uid: attachment.messageId,
+						type: 'message-attachment',
+					})
+				}
+			}
+
+			if (original.inlineAttachments) {
+				for (const inlineAttachment of original.inlineAttachments) {
+					attachments.push({
+						...inlineAttachment,
+						databaseId: original.databaseId,
+						mailboxId: original.mailboxId,
+						// messageId for attachments is actually the uid
+						uid: inlineAttachment.messageId,
+						type: 'message-attachment-inline',
+					})
+				}
+			}
+
+			return attachments
+		},
 		async stopComposerSession({
 			restoreOriginalSendAt = false,
 			moveToImap = false,
diff --git a/tests/Unit/Controller/MessagesControllerTest.php b/tests/Unit/Controller/MessagesControllerTest.php
index 8577019883..b8837778c1 100644
--- a/tests/Unit/Controller/MessagesControllerTest.php
+++ b/tests/Unit/Controller/MessagesControllerTest.php
@@ -477,6 +477,8 @@ public function testDownloadAttachments() {
 				'image/png',
 				'abcdefg',
 				7,
+				null,
+				null,
 			),
 		];
 
diff --git a/tests/Unit/Db/LocalAttachmentTest.php b/tests/Unit/Db/LocalAttachmentTest.php
new file mode 100644
index 0000000000..f8eae85136
--- /dev/null
+++ b/tests/Unit/Db/LocalAttachmentTest.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Mail\Tests\Unit\Db;
+
+use ChristophWurst\Nextcloud\Testing\TestCase;
+use OCA\Mail\Db\LocalAttachment;
+
+class LocalAttachmentTest extends TestCase {
+	public function testIsDispositionAttachmentOrInlineWithAttachment(): void {
+		$attachment = new LocalAttachment();
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_ATTACHMENT);
+
+		$this->assertTrue($attachment->isDispositionAttachmentOrInline());
+	}
+
+	public function testIsDispositionAttachmentOrInlineWithInline(): void {
+		$attachment = new LocalAttachment();
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_INLINE);
+
+		$this->assertTrue($attachment->isDispositionAttachmentOrInline());
+	}
+
+	public function testIsDispositionAttachmentOrInlineWithNull(): void {
+		$attachment = new LocalAttachment();
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_OMIT);
+
+		$this->assertFalse($attachment->isDispositionAttachmentOrInline());
+	}
+
+	public function testIsDispositionAttachmentOrInlineWithNoDispositionSet(): void {
+		$attachment = new LocalAttachment();
+
+		$this->assertFalse($attachment->isDispositionAttachmentOrInline());
+	}
+}
diff --git a/tests/Unit/IMAP/MessageMapperTest.php b/tests/Unit/IMAP/MessageMapperTest.php
index b51f871573..864bcca156 100644
--- a/tests/Unit/IMAP/MessageMapperTest.php
+++ b/tests/Unit/IMAP/MessageMapperTest.php
@@ -778,7 +778,7 @@ public function testGetAttachmentFilenameFromContentDisposition(): void {
 		);
 
 		$this->assertEquals('test.pdf', $attachment->getName());
-		$this->assertEquals('application/octet-stream', $attachment->getType());
+		$this->assertEquals('application/pdf', $attachment->getType());
 		$this->assertEquals($bodyContent, $attachment->getContent());
 	}
 
@@ -807,7 +807,7 @@ public function testGetAttachmentFilenameFromContentTypeName(): void {
 		);
 
 		$this->assertEquals('fallback.pdf', $attachment->getName());
-		$this->assertEquals('application/octet-stream', $attachment->getType());
+		$this->assertEquals('application/pdf', $attachment->getType());
 	}
 
 	public function testGetAttachmentTextCalendarContentType(): void {
@@ -908,7 +908,8 @@ public function testGetAttachmentEncryptedWithRegularAttachment(): void {
 		);
 
 		$this->assertEquals('report.pdf', $attachment->getName());
-		$this->assertEquals('application/octet-stream', $attachment->getType());
+		$this->assertEquals('application/pdf', $attachment->getType());
+		$this->assertEquals('attachment', $attachment->disposition);
 	}
 
 	public function testGetAttachmentEncryptedWithInlineImage(): void {
@@ -926,6 +927,7 @@ public function testGetAttachmentEncryptedWithInlineImage(): void {
 		);
 
 		$this->assertEquals('nextcloud.png', $attachment->getName());
-		$this->assertEquals('application/octet-stream', $attachment->getType());
+		$this->assertEquals('image/png', $attachment->getType());
+		$this->assertEquals('inline', $attachment->disposition);
 	}
 }
diff --git a/tests/Unit/Service/Attachment/AttachmentServiceTest.php b/tests/Unit/Service/Attachment/AttachmentServiceTest.php
index 36cdf600aa..d0984d7c81 100644
--- a/tests/Unit/Service/Attachment/AttachmentServiceTest.php
+++ b/tests/Unit/Service/Attachment/AttachmentServiceTest.php
@@ -97,6 +97,7 @@ public function testAddFileWithUploadException() {
 			'userId' => $userId,
 			'fileName' => 'cat.jpg',
 			'createdAt' => 123456,
+			'disposition' => LocalAttachment::DISPOSITION_ATTACHMENT,
 		]);
 		$persistedAttachment = LocalAttachment::fromParams([
 			'id' => 123,
@@ -129,12 +130,14 @@ public function testAddFile() {
 		$attachment = LocalAttachment::fromParams([
 			'userId' => $userId,
 			'fileName' => 'cat.jpg',
-			'createdAt' => 123456
+			'createdAt' => 123456,
+			'disposition' => LocalAttachment::DISPOSITION_ATTACHMENT,
 		]);
 		$persistedAttachment = LocalAttachment::fromParams([
 			'id' => 123,
 			'userId' => $userId,
 			'fileName' => 'cat.jpg',
+			'disposition' => LocalAttachment::DISPOSITION_ATTACHMENT,
 		]);
 
 		$this->mapper->expects($this->once())
@@ -154,6 +157,8 @@ public function testAddFileFromStringWithUploadException() {
 			'userId' => $userId,
 			'fileName' => 'cat.jpg',
 			'mimeType' => 'image/jpg',
+			'contentId' => null,
+			'disposition' => null,
 			'createdAt' => 123456,
 		]);
 		$persistedAttachment = LocalAttachment::fromParams([
@@ -169,14 +174,14 @@ public function testAddFileFromStringWithUploadException() {
 			->willReturn($persistedAttachment);
 		$this->storage->expects($this->once())
 			->method('saveContent')
-			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds'))
+			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('Lorem ipsum dolor sit amet'))
 			->willThrowException(new NotPermittedException());
 		$this->mapper->expects($this->once())
 			->method('delete')
 			->with($this->equalTo($persistedAttachment));
 		$this->expectException(UploadException::class);
 
-		$this->service->addFileFromString($userId, 'cat.jpg', 'image/jpg', 'sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds');
+		$this->service->addFileFromString($userId, 'cat.jpg', 'image/jpg', 'Lorem ipsum dolor sit amet', null, null);
 	}
 
 	public function testAddFileFromString() {
@@ -200,9 +205,16 @@ public function testAddFileFromString() {
 			->willReturn($persistedAttachment);
 		$this->storage->expects($this->once())
 			->method('saveContent')
-			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds'));
-
-		$this->service->addFileFromString($userId, 'cat.jpg', 'image/jpg', 'sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds');
+			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('Lorem ipsum dolor sit amet'));
+
+		$this->service->addFileFromString(
+			$userId,
+			'cat.jpg',
+			'image/jpg',
+			'Lorem ipsum dolor sit amet',
+			null,
+			null,
+		);
 	}
 
 	public function testDeleteAttachment(): void {
@@ -336,14 +348,14 @@ public function testHandleAttachmentsForwardedMessageAttachment(): void {
 		$this->messageMapper->expects(self::once())
 			->method('getFullText')
 			->with($client, $mailbox->getName(), $message->getUid(), $userId)
-			->willReturn('sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds');
+			->willReturn('Lorem ipsum dolor sit amet');
 		$this->mapper->expects($this->once())
 			->method('insert')
 			->with($this->equalTo($attachment))
 			->willReturn($persistedAttachment);
 		$this->storage->expects($this->once())
 			->method('saveContent')
-			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds'));
+			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('Lorem ipsum dolor sit amet'));
 		$this->service->handleAttachments($account, [$attachments], $client);
 	}
 
@@ -353,6 +365,8 @@ public function testHandleAttachmentsForwardedAttachment(): void {
 			'userId' => $userId,
 			'fileName' => 'cat.jpg',
 			'mimeType' => 'text/plain',
+			'contentId' => null,
+			'disposition' => 'attachment',
 			'createdAt' => 123456,
 		]);
 		$persistedAttachment = LocalAttachment::fromParams([
@@ -373,18 +387,27 @@ public function testHandleAttachmentsForwardedAttachment(): void {
 			'type' => 'message-attachment',
 			'mailboxId' => $mailbox->getId(),
 			'uid' => 999,
+			'id' => '2',
 			'fileName' => 'cat.jpg',
 			'mimeType' => 'text/plain',
 		];
-		$imapAttachment = ['sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds'];
+		$imapAttachment = new \OCA\Mail\Attachment(
+			'2',
+			'cat.jpg',
+			'text/plain',
+			'Lorem ipsum dolor sit amet',
+			strlen('Lorem ipsum dolor sit amet'),
+			null,
+			'attachment',
+		);
 
 		$this->mailManager->expects(self::once())
 			->method('getMailbox')
 			->with($account->getUserId(), $mailbox->getId())
 			->willReturn($mailbox);
 		$this->messageMapper->expects(self::once())
-			->method('getRawAttachments')
-			->with($client, $mailbox->getName(), 999)
+			->method('getAttachment')
+			->with($client, $mailbox->getName(), 999, '2', $userId)
 			->willReturn($imapAttachment);
 		$this->mapper->expects($this->once())
 			->method('insert')
@@ -392,7 +415,7 @@ public function testHandleAttachmentsForwardedAttachment(): void {
 			->willReturn($persistedAttachment);
 		$this->storage->expects($this->once())
 			->method('saveContent')
-			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds'));
+			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('Lorem ipsum dolor sit amet'));
 
 		$this->service->handleAttachments($account, [$attachments], $client);
 	}
@@ -420,7 +443,7 @@ public function testHandleAttachmentsCloudAttachmentNoDownloadPermission(): void
 		$file = $this->createConfiguredMock(File::class, [
 			'getName' => 'cat.jpg',
 			'getMimeType' => 'text/plain',
-			'getContent' => 'sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds',
+			'getContent' => 'Lorem ipsum dolor sit amet',
 			'getStorage' => $storage
 		]);
 		$account = $this->createConfiguredMock(Account::class, [
@@ -452,7 +475,7 @@ public function testHandleAttachmentsCloudAttachment(): void {
 		$file = $this->createConfiguredMock(File::class, [
 			'getName' => 'cat.jpg',
 			'getMimeType' => 'text/plain',
-			'getContent' => 'sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds',
+			'getContent' => 'Lorem ipsum dolor sit amet',
 			'getStorage' => $this->createMock(SharedStorage::class)
 		]);
 		$account = $this->createConfiguredMock(Account::class, [
@@ -492,7 +515,7 @@ public function testHandleAttachmentsCloudAttachment(): void {
 			->willReturn($persistedAttachment);
 		$this->storage->expects($this->once())
 			->method('saveContent')
-			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('sjdhfkjsdhfkjsdhfkjdshfjhdskfjhds'));
+			->with($this->equalTo($userId), $this->equalTo(123), $this->equalTo('Lorem ipsum dolor sit amet'));
 
 		$this->service->handleAttachments($account, [$attachments], $client);
 	}
diff --git a/tests/Unit/Service/HtmlPurify/TransformCidDataAttrTest.php b/tests/Unit/Service/HtmlPurify/TransformCidDataAttrTest.php
new file mode 100644
index 0000000000..23e5a557c8
--- /dev/null
+++ b/tests/Unit/Service/HtmlPurify/TransformCidDataAttrTest.php
@@ -0,0 +1,156 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Mail\Tests\Unit\Service\HtmlPurify;
+
+use ChristophWurst\Nextcloud\Testing\TestCase;
+use HTMLPurifier_Config;
+use HTMLPurifier_Context;
+use HTMLPurifier_Token_Start;
+use OCA\Mail\Service\HtmlPurify\TransformCidDataAttr;
+
+class TransformCidDataAttrTest extends TestCase {
+	private HTMLPurifier_Config $config;
+
+	private array $inlineAttachments = [
+		[
+			'cid' => 'image001@example.com',
+			'url' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7',
+		],
+		[
+			'cid' => 'image002@example.com',
+			'url' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/8',
+		],
+	];
+
+	protected function setUp(): void {
+		parent::setUp();
+		$this->config = HTMLPurifier_Config::createDefault();
+	}
+
+	private function makeContext(string $tagName = 'img'): HTMLPurifier_Context {
+		$context = new HTMLPurifier_Context();
+		$token = new HTMLPurifier_Token_Start($tagName);
+		$context->register('CurrentToken', $token);
+		return $context;
+	}
+
+	public function testNonImgTagIsUnchanged(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7'];
+		$context = $this->makeContext('div');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertArrayNotHasKey('data-cid', $result);
+	}
+
+	public function testImgWithoutSrcIsUnchanged(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		$attr = ['alt' => 'image'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertArrayNotHasKey('data-cid', $result);
+	}
+
+	public function testMatchingSrcSetsCidAttribute(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertSame('image001@example.com', $result['data-cid']);
+	}
+
+	public function testSecondAttachmentMatches(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/8'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertSame('image002@example.com', $result['data-cid']);
+	}
+
+	public function testNonMatchingSrcLeavesNoCidAttribute(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/99'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertArrayNotHasKey('data-cid', $result);
+	}
+
+	public function testPathComparisonIgnoresSchemeAndHost(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		// Same path, different scheme/host (e.g. behind a reverse proxy)
+		$attr = ['src' => 'http://internal.proxy/index.php/apps/mail/api/messages/42/attachments/7'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertSame('image001@example.com', $result['data-cid']);
+	}
+
+	public function testAttachmentWithoutCidIsSkipped(): void {
+		$attachments = [
+			['url' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7'],
+		];
+		$transform = new TransformCidDataAttr($attachments);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertArrayNotHasKey('data-cid', $result);
+	}
+
+	public function testAttachmentWithoutUrlIsSkipped(): void {
+		$attachments = [
+			['cid' => 'image001@example.com'],
+		];
+		$transform = new TransformCidDataAttr($attachments);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertArrayNotHasKey('data-cid', $result);
+	}
+
+	public function testEmptyInlineAttachments(): void {
+		$transform = new TransformCidDataAttr([]);
+		$attr = ['src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7'];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertArrayNotHasKey('data-cid', $result);
+	}
+
+	public function testExistingAttributesArePreserved(): void {
+		$transform = new TransformCidDataAttr($this->inlineAttachments);
+		$attr = [
+			'src' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/7',
+			'alt' => 'inline image',
+			'width' => '100',
+		];
+		$context = $this->makeContext('img');
+
+		$result = $transform->transform($attr, $this->config, $context);
+
+		$this->assertSame('inline image', $result['alt']);
+		$this->assertSame('100', $result['width']);
+		$this->assertSame('image001@example.com', $result['data-cid']);
+	}
+}
diff --git a/tests/Unit/Service/HtmlPurify/TransformURLSchemeTest.php b/tests/Unit/Service/HtmlPurify/TransformURLSchemeTest.php
index 607c132535..d00583e395 100644
--- a/tests/Unit/Service/HtmlPurify/TransformURLSchemeTest.php
+++ b/tests/Unit/Service/HtmlPurify/TransformURLSchemeTest.php
@@ -10,7 +10,6 @@
 namespace OCA\Mail\Tests\Unit\Service\HtmlPurify;
 
 use ChristophWurst\Nextcloud\Testing\TestCase;
-use Closure;
 use HTMLPurifier_Config;
 use HTMLPurifier_Context;
 use HTMLPurifier_URI;
@@ -23,29 +22,18 @@ class TransformURLSchemeTest extends TestCase {
 	private TransformURLScheme $filter;
 	private IURLGenerator|MockObject $urlGenerator;
 	private IRequest|MockObject $request;
-	private Closure $mapCidToAttachmentId;
+
+	private array $inlineAttachments = [
+		['cid' => 'valid-cid', 'url' => 'https://mail.example.com/index.php/apps/mail/api/messages/42/attachments/123'],
+	];
 
 	protected function setUp(): void {
 		parent::setUp();
 		$this->urlGenerator = $this->createMock(IURLGenerator::class);
 		$this->request = $this->createMock(IRequest::class);
 
-		$this->mapCidToAttachmentId = function (string $cid) {
-			if ($cid === 'valid-cid') {
-				return 123;
-			}
-			return null;
-		};
-
-		$messageParameters = [
-			'accountId' => 1,
-			'folderId' => 'INBOX',
-			'id' => 42,
-		];
-
 		$this->filter = new TransformURLScheme(
-			$messageParameters,
-			$this->mapCidToAttachmentId,
+			$this->inlineAttachments,
 			$this->urlGenerator,
 			$this->request,
 		);
@@ -211,11 +199,6 @@ public function testCidSchemeWithValidAttachment(): void {
 		$config = HTMLPurifier_Config::createDefault();
 		$context = new HTMLPurifier_Context();
 
-		$this->urlGenerator->expects($this->once())
-			->method('linkToRouteAbsolute')
-			->with('mail.messages.downloadAttachment', $this->anything())
-			->willReturn('https://mail.example.com/download/123');
-
 		$result = $this->filter->filter($uri, $config, $context);
 
 		$this->assertTrue($result);
@@ -291,34 +274,17 @@ public function testUriWithFragment(): void {
 		$this->assertStringContainsString('%23section', $uri->query);
 	}
 
-	public function testCidSchemeMapsCidToAttachmentId(): void {
-		$messageParameters = [
-			'accountId' => 1,
-			'folderId' => 'INBOX',
-			'id' => 42,
-		];
-
-		$filter = new TransformURLScheme(
-			$messageParameters,
-			$this->mapCidToAttachmentId,
-			$this->urlGenerator,
-			$this->request,
-		);
-
+	public function testCidSchemeRewritesUriFromUrl(): void {
 		$uri = new HTMLPurifier_URI('cid', null, null, null, 'valid-cid', null, null);
 		$config = HTMLPurifier_Config::createDefault();
 		$context = new HTMLPurifier_Context();
 
-		$this->urlGenerator->expects($this->once())
-			->method('linkToRouteAbsolute')
-			->with('mail.messages.downloadAttachment', [
-				'accountId' => 1,
-				'folderId' => 'INBOX',
-				'id' => 42,
-				'attachmentId' => 123,
-			])
-			->willReturn('https://mail.example.com/download/123');
-
-		$filter->filter($uri, $config, $context);
+		$this->urlGenerator->expects($this->never())->method('linkToRouteAbsolute');
+
+		$this->filter->filter($uri, $config, $context);
+
+		$this->assertSame('https', $uri->scheme);
+		$this->assertSame('mail.example.com', $uri->host);
+		$this->assertStringContainsString('/apps/mail/api/messages/42/attachments/123', $uri->path);
 	}
 }
diff --git a/tests/Unit/Service/MailManagerTest.php b/tests/Unit/Service/MailManagerTest.php
index 0cd1f549d0..5bd24acc40 100644
--- a/tests/Unit/Service/MailManagerTest.php
+++ b/tests/Unit/Service/MailManagerTest.php
@@ -537,7 +537,9 @@ public function testGetMailAttachments(): void {
 				'cat.png',
 				'image/png',
 				'abcdefg',
-				7
+				7,
+				null,
+				null,
 			),
 		];
 		$client = $this->createStub(Horde_Imap_Client_Socket::class);
diff --git a/tests/Unit/Service/MimeMessageTest.php b/tests/Unit/Service/MimeMessageTest.php
index 2d17703d9a..146a3bf26c 100644
--- a/tests/Unit/Service/MimeMessageTest.php
+++ b/tests/Unit/Service/MimeMessageTest.php
@@ -47,6 +47,7 @@ public function testTextPlain() {
 		$part = $this->mimeMessage->build(
 			$messageData->getBody(),
 			null,
+			false,
 			[],
 		);
 
@@ -69,6 +70,7 @@ public function testMultipartAlternative() {
 		$part = $this->mimeMessage->build(
 			$messageData->getBody(),
 			$messageData->getBody(),
+			false,
 			[],
 		);
 
@@ -97,6 +99,7 @@ public function testMultipartAlternativeEmptyContent() {
 		$part = $this->mimeMessage->build(
 			$messageData->getBody(),
 			$messageData->getBody(),
+			false,
 			[],
 		);
 
@@ -122,15 +125,17 @@ public function testMultipartMixedAlternative() {
 			false
 		);
 
-		$attachment1 = $this->createAttachmentDetails(
+		$attachment1 = $this->createAttachmentPart(
 			'nextcloud logo',
 			file_get_contents(__DIR__ . '/../../../tests/data/nextcloud.png'),
-			'image/png'
+			'image/png',
+			'attachment',
 		);
 
 		$part = $this->mimeMessage->build(
 			$messageData->getBody(),
 			$messageData->getBody(),
+			false,
 			[$attachment1],
 		);
 
@@ -167,21 +172,24 @@ public function testMultipartMixedRelated() {
 			false
 		);
 
-		$attachment1 = $this->createAttachmentDetails(
+		$attachment1 = $this->createAttachmentPart(
 			'nextcloud logo',
 			file_get_contents(__DIR__ . '/../../../tests/data/nextcloud.png'),
-			'image/png'
+			'image/png',
+			'attachment',
 		);
 
-		$attachment2 = $this->createAttachmentDetails(
+		$attachment2 = $this->createAttachmentPart(
 			'sensitive animals logo',
 			file_get_contents(__DIR__ . '/../../../tests/data/test.txt'),
-			'text/plain'
+			'text/plain',
+			'attachment',
 		);
 
 		$part = $this->mimeMessage->build(
 			$messageData->getBody(),
 			$messageData->getBody(),
+			false,
 			[$attachment1, $attachment2],
 		);
 
@@ -224,6 +232,106 @@ public function testMultipartMixedRelated() {
 		$this->assertEquals('attachment', $attachmentPart2->getDisposition());
 	}
 
+	public function testInlineAttachmentGoesIntoMultipartRelated(): void {
+		$inlinePart = $this->createAttachmentPart(
+			'inline image',
+			file_get_contents(__DIR__ . '/../../../tests/data/nextcloud.png'),
+			'image/png',
+			'inline',
+		);
+		$inlinePart->setContentId('test-inline-image@example.com');
+
+		$part = $this->mimeMessage->build(
+			'Hello',
+			'<p>Hello</p>',
+			false,
+			[$inlinePart],
+		);
+
+		$this->assertEquals('multipart/related', $part->getType());
+
+		/** @var Horde_Mime_Part[] $subParts */
+		$subParts = $part->getParts();
+		$this->assertCount(2, $subParts);
+		$this->assertEquals('inline', $subParts[1]->getDisposition());
+		$this->assertEquals('image/png', $subParts[1]->getType());
+		$this->assertEquals('test-inline-image@example.com', $subParts[1]->getContentId());
+	}
+
+	public function testInlineAndNormalAttachmentsSeparated(): void {
+		$inlinePart = $this->createAttachmentPart(
+			'inline image',
+			file_get_contents(__DIR__ . '/../../../tests/data/nextcloud.png'),
+			'image/png',
+			'inline',
+		);
+		$inlinePart->setContentId('test-inline-image@example.com');
+
+		$normalPart = $this->createAttachmentPart(
+			'document.txt',
+			'some content',
+			'text/plain',
+			'attachment',
+		);
+
+		$part = $this->mimeMessage->build(
+			'Hello',
+			'<p>Hello</p>',
+			false,
+			[$inlinePart, $normalPart],
+		);
+
+		// multipart/mixed wraps (multipart/related + normal attachment)
+		$this->assertEquals('multipart/mixed', $part->getType());
+
+		/** @var Horde_Mime_Part[] $subParts */
+		$subParts = $part->getParts();
+		$this->assertCount(2, $subParts);
+
+		$this->assertEquals('multipart/related', $subParts[0]->getType());
+		$this->assertEquals('attachment', $subParts[1]->getDisposition());
+
+		$relatedSubParts = $subParts[0]->getParts();
+		$this->assertEquals('inline', $relatedSubParts[1]->getDisposition());
+		$this->assertEquals('test-inline-image@example.com', $relatedSubParts[1]->getContentId());
+	}
+
+	public function testRewriteSrcToCidFromDataCidAttribute(): void {
+		$inlinePart = $this->createAttachmentPart(
+			'inline image',
+			file_get_contents(__DIR__ . '/../../../tests/data/nextcloud.png'),
+			'image/png',
+			'inline',
+		);
+		$inlinePart->setContentId('test-inline-image@example.com');
+
+		$html = '<p><img src="https://example.com/image.png" data-cid="test-inline-image@example.com" /></p>';
+
+		$part = $this->mimeMessage->build(
+			null,
+			$html,
+			false,
+			[$inlinePart],
+		);
+
+		$this->assertEquals('multipart/related', $part->getType());
+
+		$relatedSubParts = $part->getParts();
+		$this->assertCount(2, $relatedSubParts);
+
+		$alternativePart = $relatedSubParts[0];
+		$this->assertEquals('multipart/alternative', $alternativePart->getType());
+
+		$alternativeSubParts = $alternativePart->getParts();
+		$this->assertCount(2, $alternativeSubParts);
+		$this->assertEquals('text/plain', $alternativeSubParts[0]->getType());
+		$this->assertEquals('text/html', $alternativeSubParts[1]->getType());
+
+		$htmlBody = $alternativeSubParts[1]->getContents();
+		$this->assertStringContainsString('cid:test-inline-image@example.com', $htmlBody);
+		$this->assertStringNotContainsString('data-cid', $htmlBody);
+	}
+
 	public function testMultipartAlternativeGreek() {
 		$messageData = new NewMessageData(
 			$this->account,
@@ -240,6 +348,7 @@ public function testMultipartAlternativeGreek() {
 		$part = $this->mimeMessage->build(
 			null,
 			$messageData->getBody(),
+			false,
 			[],
 		);
 
@@ -267,18 +376,47 @@ public function testMultipartAlternativeGreek() {
 		);
 	}
 
-	/**
-	 * OCA\Mail\Model\Message::createAttachmentDetails
-	 *
-	 * @param string $name
-	 * @param string $content
-	 * @param string $mime
-	 * @return void
-	 */
-	private function createAttachmentDetails(string $name, string $content, string $mime): Horde_Mime_Part {
+	public function testEmbeddedImageSkipNonImages(): void {
+		$body = file_get_contents(__DIR__ . '/../../../tests/data/mime-html-image.txt');
+		// replace image/png type with a non-image type to trigger the skip.
+		$body = str_replace('data:image/png;base64,', 'data:text/html;base64,', $body);
+
+		$messageData = new NewMessageData(
+			$this->account,
+			new AddressList(),
+			new AddressList(),
+			new AddressList(),
+			'Text, HTML but invalid inline image',
+			$body,
+			[],
+			true,
+			false
+		);
+
+		$part = $this->mimeMessage->build(
+			$messageData->getBody(),
+			$messageData->getBody(),
+			false,
+			[],
+		);
+
+		$this->assertEquals('multipart/alternative', $part->getType());
+
+		/** @var Horde_Mime_Part[] $alternativeSubParts */
+		$alternativeSubParts = $part->getParts();
+		$this->assertCount(2, $alternativeSubParts);
+		$this->assertEquals('text/plain', $alternativeSubParts[0]->getType());
+		$this->assertEquals('text/html', $alternativeSubParts[1]->getType());
+
+		$htmlBody = $alternativeSubParts[1]->getContents();
+		$this->assertStringContainsString('data:text/html;base64,', $htmlBody);
+		$this->assertStringNotContainsString('data-cid', $htmlBody);
+	}
+
+	private function createAttachmentPart(string $name, string $content, string $mime, string $disposition): Horde_Mime_Part {
 		$part = new Horde_Mime_Part();
 		$part->setCharset('us-ascii');
-		$part->setDisposition('attachment');
+		$part->setDisposition($disposition);
 		$part->setName($name);
 		$part->setContents($content);
 		$part->setType($mime);
diff --git a/tests/Unit/Service/TransmissionServiceTest.php b/tests/Unit/Service/TransmissionServiceTest.php
index db060d2f30..7ba3bbfe9b 100644
--- a/tests/Unit/Service/TransmissionServiceTest.php
+++ b/tests/Unit/Service/TransmissionServiceTest.php
@@ -91,6 +91,7 @@ public function testHandleAttachment(): void {
 		$attachment = new LocalAttachment();
 		$attachment->setFileName('test.txt');
 		$attachment->setMimeType('text/plain');
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_ATTACHMENT);
 
 		$file = new InMemoryFile(
 			'test.txt',
@@ -355,23 +356,48 @@ public function testHandleAttachmentKeepAdditionalContentTypeParameters(): void
 		$mailAccount = new MailAccount();
 		$mailAccount->setUserId('bob');
 		$account = new Account($mailAccount);
-
 		$attachment = new LocalAttachment();
-		$attachment->setFileName('event.ics');
-		$attachment->setMimeType('text/calendar; method=REQUEST');
-
+		$attachment->setFileName(null);
+		$attachment->setMimeType('text/calendar; method=REQUEST; charset="utf-8"; name=event.ics');
+		// iMIP attachments must not carry a Content-Disposition header.
+		// See https://github.com/nextcloud/mail/issues/10416
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_OMIT);
 		$file = new InMemoryFile(
 			'event.ics',
 			"BEGIN:VCALENDAR\nEND:VCALENDAR"
 		);
-
 		$this->attachmentService->expects(self::once())
 			->method('getAttachment')
 			->willReturn([$attachment, $file]);
 
 		$part = $this->transmissionService->handleAttachment($account, ['id' => 1, 'type' => 'local']);
 
-		$this->assertEquals('event.ics', $part->getContentTypeParameter('name'));
+		$this->assertEquals('text/calendar', $part->getType());
 		$this->assertEquals('REQUEST', $part->getContentTypeParameter('method'));
+		$this->assertEquals('utf-8', $part->getContentTypeParameter('charset'));
+		$this->assertEquals('event.ics', $part->getContentTypeParameter('name'));
+	}
+
+	public function testHandleAttachmentImipOmitsContentDisposition(): void {
+		$mailAccount = new MailAccount();
+		$mailAccount->setUserId('bob');
+		$account = new Account($mailAccount);
+		$attachment = new LocalAttachment();
+		$attachment->setFileName(null);
+		$attachment->setMimeType('text/calendar; method=REQUEST; charset="utf-8"; name=event.ics');
+		// iMIP attachments must not carry a Content-Disposition header.
+		// See https://github.com/nextcloud/mail/issues/10416
+		$attachment->setDisposition(LocalAttachment::DISPOSITION_OMIT);
+		$file = new InMemoryFile(
+			'event.ics',
+			"BEGIN:VCALENDAR\nEND:VCALENDAR"
+		);
+		$this->attachmentService->expects(self::once())
+			->method('getAttachment')
+			->willReturn([$attachment, $file]);
+
+		$part = $this->transmissionService->handleAttachment($account, ['id' => 1, 'type' => 'local']);
+
+		$this->assertEquals('', $part->getDisposition());
 	}
 }
diff --git a/tests/stubs/php-polyfill.php b/tests/stubs/php-polyfill.php
new file mode 100644
index 0000000000..6070fe6997
--- /dev/null
+++ b/tests/stubs/php-polyfill.php
@@ -0,0 +1,14 @@
+<?php
+
+/*
+ * SPDX-FileCopyrightText: None
+ * SPDX-License-Identifier: CC0-1.0
+ */
+
+// PHP 8.4
+function array_find(array $array, callable $callback) {
+}
+
+// PHP 8.5
+function array_any(array $array, callable $callback): bool {
+}