CVE-2026-114727
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and can reference external resources and invoke ImageMagick delegates.
Risk Assessment
A malicious SVG or EPS file uploaded as a contact photo may be processed by ImageMagick, potentially leading to code execution or data disclosure on the server.
Recommendation
Upgrade Roundcube Webmail to version 1.6.20 or 1.7.5 (or later), which removes SVG and EPS from accepted image types.
Other vulnerabilities in Roundcube Webmail
See all- CVE-2015-5383High
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
- CVE-2017-8114High
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- CVE-2016-4069High
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
- CVE-2024-37383MediumActively exploited
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. This could lead to execution of malicious JavaScript in the victim's browser.
- CVE-2020-35730MediumActively exploited
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
- CVE-2020-13965MediumActively exploited
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
- CVE-2020-12641CriticalActively exploited
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
- CVE-2026-114732Medium
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host.
- CVE-2026-114731Medium
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (utils/modcss action). The fetched stylesheet was read into memory in full with no size limit and no read timeout, allowing server memory exhaustion via an attacker-controlled stylesheet URL.
- CVE-2026-114730High
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48, and the unspecified address ::/128, allowing URLs such as http://[64:ff9b::7f00:1]/ to reach loopback, link-local, and cloud metadata addresses.
Original NVD description (English source)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS