Roundcube Webmail: Unsafe image processing via ImageMagick in contact photo upload
Summary
Roundcube Webmail accepted SVG and EPS files as contact photo uploads and passed them unsafely to ImageMagick during resizing. Because these formats can reference external resources and invoke ImageMagick delegates, an authenticated user may be able to read or manipulate data on the server. The issue affects Roundcube 1.6.0 to before 1.6.20 and 1.7.0 to before 1.7.5, and requires a valid webmail login but no user interaction.
Affected
- Roundcube Webmail 1.6.0 to before 1.6.20
- Roundcube Webmail 1.7.0 to before 1.7.5
- Only installations where ImageMagick processes contact photo uploads are affected
- Older branches: Unknown.
Fixed in
- Roundcube Webmail 1.6.20
- Roundcube Webmail 1.7.5
Workaround
- No vendor-documented workaround known.
- If upgrading is delayed, disable or restrict the contact photo upload feature (not vendor-validated).
- Restrict ImageMagick's SVG, EPS and MSL coders via its policy file (not vendor-validated).
Exploitation
- No public proof-of-concept found.
- No confirmed exploitation in the wild found.
- EPSS: 0.00331 (Vulners).
Our recommendation
- Update Roundcube to 1.6.20 or 1.7.5 without delay; check your distribution's package status, as some packages may lag.
- Check whether your Roundcube instance is reachable from the internet and whether ImageMagick processes contact photos.
- Monitor webmail logs for unusual contact photo uploads until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Roundcube security updates 1.6.20 and 1.7.5 roundcube.net
- Roundcube release 1.6.20 github.com
- Roundcube release 1.7.5 github.com
- Fix commit 895d88a github.com
- Fix commit 8f0dc2d github.com
- Debian tracker for roundcube security-tracker.debian.org
- Ubuntu CVE-2026-114727 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:23.
Original description (NVD)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
NVD references (6)
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
- https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.