CVE-2026-114727 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x before 1.7.5 contain a critical server-side request forgery vulnerability related to improper handling of image file formats during resize operations. The core technical flaw lies in the application's interaction with the ImageMagick library, where potentially unsafe content is passed directly into the processing pipeline without sufficient validation or sanitization. Specifically, the software accepts SVG and EPS files as valid types for contact photo uploads and subsequent conversion processes. This permissive input validation allows attackers to upload maliciously crafted vector graphics that exploit known behaviors within ImageMagick's delegate system.
The operational impact of this vulnerability is severe because both SVG and EPS formats are capable of referencing external resources and invoking ImageMagick delegates when processed. Delegates in ImageMagick are external programs used for handling specific file types, such as Ghostscript for PDFs or various image converters. By crafting an SVG or EPS file that includes references to these delegates with malicious parameters, an attacker can achieve arbitrary command execution on the server hosting Roundcube Webmail. This effectively transforms a simple photo upload feature into a remote code execution vector, allowing full compromise of the underlying system depending on the privileges under which the web application runs.
This vulnerability aligns with CWE-94, Improper Control of Generation of Code (Code Injection), as it involves injecting malicious commands through interpreted content that is executed by a backend service. Furthermore, from an adversary perspective, this technique maps to ATT&CK T1059 Command and Scripting Interpreter, specifically leveraging system-level interpreters via file upload mechanisms. The exploitation path typically involves uploading the crafted vector image through the contact photo interface, triggering the resize operation which invokes ImageMagick with the unsafe parameters embedded in the file structure.
The upstream developers addressed this issue by removing SVG and EPS from the list of accepted image types for processing during resize operations. This mitigation strategy effectively neutralizes the specific attack vector described by preventing the application from passing these dangerous formats to ImageMagick altogether. Organizations running affected versions should immediately upgrade to Roundcube Webmail version 1.6.20 or later, ensuring that any subsequent minor releases within the 1.7 series are also updated to at least 1.7.5. Until an update is applied, administrators may consider implementing strict file type validation at a reverse proxy level or disabling contact photo uploads entirely if not required for business operations, thereby reducing the attack surface available to potential adversaries seeking to exploit this code injection flaw.