Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | >= 1.6.0, < 1.6.20 |
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279Third Party AdvisoryMailing List
- https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013Patch
- https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e974686295678Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5Release Notes
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Issue Tracking
FAQ
What is CVE-2026-114727?
CVE-2026-114727 is a vulnerability with a CVSS score of 8.3 (HIGH). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload ...
How severe is CVE-2026-114727?
CVE-2026-114727 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114727?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail.