CVE-2026-114727
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into…
- Risk score
- 55/100
- CVSS
- 8.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upst…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.20, 1.7 or 1.7.5 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.3 high
References
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
- https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Original description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
Last activity 22 Oct 2026. Patch Forecast updates every hour.