{"id":"CVE-2026-114727","kind":"vulnerability","aliases":["CVE-2026-114727"],"related":[],"title":"Roundcube Webmail: contact photo upload passes SVG and EPS into ImageMagick","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.","summary":"Roundcube Webmail accepts SVG and EPS files as contact photo uploads and passes them to ImageMagick for resizing. Both formats can reference external resources and invoke ImageMagick delegates, which can let an attacker read files or reach internal resources on the server.","severity":"high","cvss":8.3,"epss":0.00331,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imagemagick","mail-server","package","roundcube","self-hosted"],"not_affected_if":["fixed-version","no-imagemagick"],"how_to_check":"- Check the installed Roundcube version: `1.6.x` below `1.6.20` or `1.7.x` below `1.7.5` is affected.\n- Confirm ImageMagick is used for image conversion in the Roundcube config (`im_convert_path` or the image resize path).\n- unknown whether a specific config flag disables the risky path.","fix":"- Upgrade Roundcube Webmail to `1.6.20` or `1.7.5` or later.\n- Until upgraded, remove SVG and EPS from accepted contact photo types, or disable ImageMagick-based resizing.","status":"open","published_at":"2026-10-22T02:17:00+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:02:10+00:00","updated_at":"2026-10-25T03:02:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:02:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` or `1.7.5` or later.\n- Until upgraded, remove SVG and EPS from accepted contact photo types, or disable ImageMagick-based resizing.","reach":"internet","title":"Roundcube Webmail: contact photo upload passes SVG and EPS into ImageMagick","impact":"medium","summary":"Roundcube Webmail accepts SVG and EPS files as contact photo uploads and passes them to ImageMagick for resizing. Both formats can reference external resources and invoke ImageMagick delegates, which can let an attacker read files or reach internal resources on the server.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","mail-server","imagemagick"],"confidence":0.6,"needs_auth":"yes","worst_case":"Server-side file reads or internal requests through ImageMagick delegates","analyst_note":"Check the NVD entry and the upstream commit for the exact affected version range and whether exploitation yields file read or only SSRF-like access.","how_to_check":"- Check the installed Roundcube version: `1.6.x` below `1.6.20` or `1.7.x` below `1.7.5` is affected.\n- Confirm ImageMagick is used for image conversion in the Roundcube config (`im_convert_path` or the image resize path).\n- unknown whether a specific config flag disables the risky path.","needs_analyst":true,"not_affected_if":["fixed-version","no-imagemagick"],"who_is_affected":"Roundcube Webmail installations older than `1.6.20` on the 1.6 line or older than `1.7.5` on the 1.7 line that accept contact photo uploads and resize them with ImageMagick. Any user who can upload a contact photo may be able to trigger the flaw, so the mail server operator should patch. Installations already on the fixed versions, or not using ImageMagick for resizing, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":3437,"output_tokens":707,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114727':14A,17A '-2026':13A,16A '1.6.20':72C '1.7':74C '1.7.5':77C 'accept':29B,91C,139C 'attach':125C 'attack':59B 'commit':120C 'contact':3A,35B,97C 'content':81C,126C 'convers':101C 'cve':12A,15A 'deleg':54B,112C 'ep':9A,32B,89C,136C 'extern':49B,107C 'file':33B,61B 'fix':116C,121C 'format':46B,104C 'host':26B 'imag':86C,94C,130C 'imagemagick':11A,18B,42B,53B,83C,111C,128C 'intern':64B 'invok':52B,110C 'let':57B 'mail':20B 'mail-serv':19B 'packag':22B 'pass':6A,39B,78C,122C 'photo':4A,36B,98C 'potent':123C 'potenti':79C 'process':114C 'reach':63B 'read':60B 'refer':48B,106C 'remov':133C 'resiz':44B,85C,131C 'resourc':50B,65B,108C 'roundcub':1A,23B,27B,69C 'self':25B 'self-host':24B 'server':21B,68B 'svg':7A,30B,87C,134C 'type':95C,140C 'unsaf':80C,124C 'upload':5A,37B,99C 'upstream':115C 'valid':93C 'webmail':2A,28B,70C 'x':75C","nicknames":[],"mitigations":[],"who_affected":"Roundcube Webmail installations older than `1.6.20` on the 1.6 line or older than `1.7.5` on the 1.7 line that accept contact photo uploads and resize them with ImageMagick. Any user who can upload a contact photo may be able to trigger the flaw, so the mail server operator should patch. Installations already on the fixed versions, or not using ImageMagick for resizing, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114727","severity":null,"published_at":"2026-10-22T02:17:00+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114727","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114727","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}