UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114727

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content…

Severity
High 8.3
Published
22 Oct 2026
Last changed
29 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
NVD

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cpe:a:roundcube:webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114727
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114727