Key points
- The flaw affects Roundcube Webmail versions prior to 1.6.20 and 1.7.5.
- It allows SVG and EPS files to pass unsafe content to ImageMagick.
- Vendors have released updates that remove these risky file types.
Roundcube Webmail versions before 1.6.20 and 1.7.5 contain a high-severity security flaw. The National Vulnerability Database rates CVE-2026-114727 as 8.3 on the CVSS scale. This issue arises when the application resizes images. It passes potentially unsafe content directly into ImageMagick, a powerful image processing library. This creates a significant risk for systems that allow users to upload contact photos or other image attachments.
In plain English
The problem occurs because the software accepts SVG and EPS files as valid image types. These formats are more complex than standard photos. They can reference external resources and trigger specific ImageMagick delegates during processing. This behavior allows malicious code to execute if an attacker uploads a crafted SVG or EPS file. The system treats these files as harmless images, but they act as vectors for unsafe operations.
The background
Upstream developers identified this weakness, classified under CWE-829. They created a fix that removes SVG and EPS from the list of accepted file types. The commit message describes the change as fixing the passing of potentially unsafe attachment content. This update prevents the application from handing these risky formats over to ImageMagick. The fix is included in Roundcube Webmail version 1.6.20 and version 1.7.5.
What changes now
Administrators must update their installations to the patched versions. Systems running older builds remain vulnerable to this specific image processing flaw. The update restricts file uploads to safer image formats. This change eliminates the ability for SVG and EPS files to invoke ImageMagick delegates. Organizations should verify their current version and apply the update promptly to close this gap.
Who needs to act first
Teams usually prioritize systems exposed to the internet or user uploads. Check whether your server allows contact photo uploads. If so, update the software immediately. Test the new version in a staging environment first. Back up your database and configuration files before applying changes. Monitor logs for unusual activity during the rollout. Ensure all mail servers are updated consistently to prevent lateral movement risks.
What to do and how to stay safe: Roundcube Webmail
- Verify your current Roundcube Webmail version and compare it against the patched releases.
- Apply the vendor's update to version 1.6.20 or 1.7.5 as soon as possible.
- Review server logs for any recent attempts to upload SVG or EPS files.
- Restrict file upload permissions to only trusted administrators until the patch is confirmed.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns CVE-2026-114727 a CVSS score of 8.3, which is rated as high severity.
Which file types are involved in this exploit?
The flaw involves SVG and EPS files, which were previously accepted as valid image types for contact photo uploads.
Is there a fix available for this issue?
Yes, the issue is fixed in Roundcube Webmail version 1.6.20 and version 1.7.5, which remove the unsafe file types.
