Roundcube Webmail CVE-2026-114727

Exploitation requires an authenticated Roundcube account because the vulnerable code path is the contact-photo upload feature (program/actions/contacts/upload_photo.php), which processes images via rcube_image::resize() using ImageMagick. The specific precondition is that vulnerable versions accepted 'svg' and 'eps' in the $IMAGE_TYPES allow-list by default, so no non-default configuration is needed on the Roundcube side. The concrete trigger is uploading a malicious SVG or EPS file whose content references external resources or invokes ImageMagick delegates during conversion/resize. Limiting factors: a valid mailbox login is required (PR:L), no victim user interaction is needed, and the severity of the outcome is bounded by the server's ImageMagick configuration - a restrictive policy.xml that disables the SVG/EPS/HTTPS/URL coders and risky delegates substantially mitigates the file-read, SSRF, and command-execution potential.

This is a credible, above-average priority issue rather than a CVSS-inflated one, but it is gated by authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 8.3) indicates a network-reachable, low-complexity attack that requires low-level privileges (PR:L) and no user interaction - meaning any user with a valid Roundcube mailbox can trigger it by uploading a contact photo. CWE-829 (inclusion of functionality from an untrusted control sphere) plus the description's note that SVG and EPS 'can reference external resources and invoke ImageMagick delegates' points to a classic ImageMagick delegate/SSRF/file-disclosure class of flaw (ImageTragick-style), which supports the high confidentiality and integrity ratings. No EPSS score, SSVC decision data, or CISA KEV status was provided in the input, and no public exploit was identified, so exploitation probability cannot be quantified from the data given. The main caveat: real-world impact depends heavily on the server's ImageMagick delegate/policy.xml configuration - hardened installations that disable risky coders/delegates sharply reduce the C:H/I:H outcome, so the raw 8.3 may overstate risk on well-configured hosts. Authentication (PR:L) also limits this to users who already have an account, lowering mass-exploitation likelihood versus a pre-auth flaw.

An authenticated Roundcube user (or an attacker who has phished or otherwise obtained a mailbox login) uploads a crafted SVG or EPS file as a contact photo. When Roundcube passes the file to ImageMagick for resizing, the embedded external references or delegate directives are processed, allowing the attacker to make the server fetch remote/local resources (SSRF, local file disclosure) or invoke delegate commands. No public proof-of-concept is identified in the provided data, but the technique mirrors well-documented ImageMagick delegate abuse.