DEBIAN-CVE-2026-114727

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-114727
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114727.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-114727
Upstream
Published
2026-10-22T09:47:23Z
Modified
2026-10-22T10:00:08Z
Summary
[none]
Details

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.

References

Affected packages

Debian:12 / roundcube

Package

Name
roundcube
Purl
pkg:deb/debian/roundcube?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.1+dfsg-1
1.6.2+dfsg-1
1.6.3+dfsg-1~deb12u1
1.6.3+dfsg-1
1.6.3+dfsg-2
1.6.4+dfsg-1~deb12u1
1.6.4+dfsg-1
1.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1
1.6.5+dfsg-1+deb12u2
1.6.5+dfsg-1+deb12u3
1.6.5+dfsg-1+deb12u4
1.6.5+dfsg-1+deb12u5
1.6.5+dfsg-1+deb12u6
1.6.5+dfsg-1+deb12u7
1.6.5+dfsg-1+deb12u8
1.6.5+dfsg-1+deb12u9
1.6.5+dfsg-1+deb12u10
1.6.5+dfsg-1+deb12u11
1.6.5+dfsg-1+deb12u12
1.6.6+dfsg-1
1.6.6+dfsg-2
1.6.7+dfsg-1
1.6.8+dfsg-1
1.6.8+dfsg-2
1.6.9+dfsg-1
1.6.9+dfsg-2
1.6.10+dfsg-1
1.6.10+dfsg-2
1.6.11+dfsg-1
1.6.12+dfsg-1
1.6.13+dfsg-1
1.6.14+dfsg-1
1.6.15+dfsg-1
1.6.16+dfsg-1
1.6.17+dfsg-1
1.6.18+dfsg-1
1.6.19+dfsg-1
1.6.20+dfsg-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114727.json"

Debian:13 / roundcube

Package

Name
roundcube
Purl
pkg:deb/debian/roundcube?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.11+dfsg-1
1.6.12+dfsg-0+deb13u1
1.6.12+dfsg-1
1.6.13+dfsg-0+deb13u1
1.6.13+dfsg-1
1.6.14+dfsg-1
1.6.15+dfsg-0+deb13u1
1.6.15+dfsg-1
1.6.16+dfsg-0+deb13u1
1.6.16+dfsg-1
1.6.17+dfsg-0+deb13u1
1.6.17+dfsg-1
1.6.18+dfsg-0+deb13u1
1.6.18+dfsg-1
1.6.19+dfsg-0+deb13u1
1.6.19+dfsg-1
1.6.20+dfsg-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114727.json"

Debian:14 / roundcube

Package

Name
roundcube
Purl
pkg:deb/debian/roundcube?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6.20+dfsg-1

Affected versions

1.*
1.6.11+dfsg-1
1.6.12+dfsg-1
1.6.13+dfsg-1
1.6.14+dfsg-1
1.6.15+dfsg-1
1.6.16+dfsg-1
1.6.17+dfsg-1
1.6.18+dfsg-1
1.6.19+dfsg-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114727.json"