CVE-2026-114727: CWE-829 Inclusion of Functionality from Untrusted Control Sphere in Roundcube Webmail
Description
CVE-2026-114727 is a high-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. The issue involves unsafe handling of SVG and EPS image formats during contact photo uploads, where these formats are passed to ImageMagick for resizing. Since SVG and EPS can reference external resources and invoke ImageMagick delegates, this can lead to inclusion of functionality from an untrusted control sphere. The vulnerability is fixed by removing SVG and EPS from accepted image types.
CVSS v3.1
Score 8.3high
Affected software
Roundcube
Webmail
pkg:github/WebmailRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Roundcube Webmail versions prior to 1.6.20 and 1.7.5 accept SVG and EPS image formats for contact photo uploads and pass them to ImageMagick for resizing. Both SVG and EPS formats can reference external resources and invoke ImageMagick delegates, which introduces a CWE-829 vulnerability (Inclusion of Functionality from Untrusted Control Sphere). This can lead to potential remote code execution or other impacts due to unsafe processing of these image types. The upstream fix removes SVG and EPS from the accepted image types to mitigate this risk.
Potential Impact
The vulnerability allows an attacker to upload SVG or EPS images that can reference external resources or invoke ImageMagick delegates, potentially leading to remote code execution or unauthorized actions within the context of the Roundcube Webmail server. The CVSS score of 8.3 reflects high impact on confidentiality and integrity, with low attack complexity and no user interaction required.
Mitigation Recommendations
A fix is available and has been applied upstream by removing SVG and EPS from the accepted image types for contact photo uploads. Users should upgrade Roundcube Webmail to version 1.6.20 or later, or 1.7.5 or later to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-10-22T01:59:00.397Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad9728b4d27ba8daa1e910d
Added to database: 10/22/2026, 02:18:51 UTC
Last enriched: 10/22/2026, 02:30:16 UTC
Last updated: 10/22/2026, 02:30:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.