Live › vulnerability › CVE-2026-114727
Go to dashboardRoundcube Webmail accepts SVG and EPS files as contact photo uploads and passes them to ImageMagick for resizing. Both formats can reference external resources and invoke ImageMagick delegates, which can let an attacker read files or reach internal resources on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Roundcube Webmail installations older than on the 1.6 line or older than on the 1.7 line that accept contact photo uploads and resize them with ImageMagick. Any user who can upload a contact photo may be able to trigger the flaw, so the mail server operator should patch. Installations already on the fixed versions, or not using ImageMagick for resizing, can skip it.
1.6.201.7.5No product ranges from the sources yet.
1.6.x below 1.6.20 or 1.7.x below 1.7.5 is affected.im_convert_path or the image resize path).1.6.20 or 1.7.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
This page as .md · .json · in your agent: get_signal("CVE-2026-114727")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.