CVE-2026-114727
Description
A flaw was found in Roundcube Webmail. The application allows unsafe image types, specifically Scalable Vector Graphics (SVG) and Encapsulated PostScript (EPS), to be uploaded for contact photos. An authenticated remote attacker can exploit this vulnerability by submitting a crafted image file that ImageMagick processes during resize operations. This can invoke external processing delegates or access remote resources, potentially leading to arbitrary code execution or unauthorized information disclosure on the server.
Statement
This vulnerability is rated Important because authenticated remote attackers can achieve arbitrary command execution by uploading maliciously crafted vector images to backend conversion utilities. Although image processing runs with the privileges of the web application service, exploitation requires valid user credentials to submit profile photos. Roundcube Webmail is not shipped or supported in Red Hat Enterprise Linux, limiting exposure to community packages in EPEL and Fedora.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
