Input validation error in Roundcube Webmail - #VU156143
Published: October 19, 2026
Vulnerability identifier: #VU156143
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to subject the server's image processor to potentially unsafe attachment content, which may disrupt processing or compromise service availability.
The vulnerability exists due to insufficient restriction of attachment content passed to ImageMagick in image resizing when processing attachments. A remote attacker can supply a crafted attachment that reaches ImageMagick during resizing to expose the image processor to unsafe input and potentially disrupt service.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5