CVE-2026-114727: High severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Roundcube account with permission to upload a contact photo. The vulnerability is remotely reachable and does not require user interaction.
Which deployments are affected?
Roundcube Webmail versions before 1.6.20 and 1.7.x versions before 1.7.5 are affected where contact photo uploads are processed with ImageMagick. SVG and EPS contact-photo uploads are the relevant unsafe formats.
What should be done if an immediate upgrade is not possible?
Prevent SVG and EPS from being accepted for contact photo upload or conversion, so they cannot be passed to ImageMagick. The upstream fix removes these formats from the accepted image types.
How can I determine whether a system has been remediated?
Verify that Roundcube is running 1.6.20 or later, or 1.7.5 or later for the 1.7.x branch. Alternatively, confirm that the upstream change removing SVG and EPS from accepted image types has been applied.