ImageMagick Processing Flaw in Roundcube Webmail
CVE-2026-114727

8.3HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114727?

The Roundcube Webmail application prior to version 1.6.20 and 1.7.5 contains a significant vulnerability that permits the processing of unsafe content, particularly with respect to SVG and EPS file formats. When users upload contact photos, these formats can reference external resources and invoke ImageMagick delegates during image processing. This loophole exposes the application to potential security risks, leading to unprotected access to resources. The vulnerability has been addressed in subsequent updates which eliminate SVG and EPS file types from being accepted for upload and conversion.

Affected Version(s)

Webmail 1.6.0 < 1.6.20

Webmail 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/8f0dc2d...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.