---
id: "CVE-2026-114727"
kind: "vulnerability"
aliases: ["CVE-2026-114727"]
title: "Roundcube Webmail: contact photo upload passes SVG and EPS into ImageMagick"
severity: "high"
cvss: 8.3
epss: 0.00331
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["imagemagick", "mail-server", "package", "roundcube", "self-hosted"]
not_affected_if: ["fixed-version", "no-imagemagick"]
published_at: "2026-10-22T02:17:00+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:02:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114727", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114727", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube Webmail: contact photo upload passes SVG and EPS into ImageMagick

Roundcube Webmail accepts SVG and EPS files as contact photo uploads and passes them to ImageMagick for resizing. Both formats can reference external resources and invoke ImageMagick delegates, which can let an attacker read files or reach internal resources on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Roundcube version: `1.6.x` below `1.6.20` or `1.7.x` below `1.7.5` is affected.
- Confirm ImageMagick is used for image conversion in the Roundcube config (`im_convert_path` or the image resize path).
- unknown whether a specific config flag disables the risky path.

## Fix

- Upgrade Roundcube Webmail to `1.6.20` or `1.7.5` or later.
- Until upgraded, remove SVG and EPS from accepted contact photo types, or disable ImageMagick-based resizing.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114727
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114727

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_