{"id":"CVE-2026-114727","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-114727","generatedAt":"2026-10-27T23:50:17.386Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.","published":"2026-10-22T02:17:01.000Z","lastModified":"2026-10-22T16:45:50.000Z","status":"Undergoing Analysis","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":8.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"},"cwe":["CWE-829"],"affected":[],"epss":{"score":0.00332,"percentile":0.26169,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00331,"percentile":0.25091}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-22T02:17:01.000Z","detail":{"score":"8.3","severity":"HIGH","publishedAt":"2026-10-22T02:17:00.797Z"},"summary":"New CVE, high severity (CVSS 8.3)."}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org"},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114727","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}