Input validation error in Roundcube Webmail - #VU162696
Published: November 9, 2026
Vulnerability identifier: #VU162696
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause potentially unsafe attachment content to be processed by ImageMagick.
The vulnerability exists due to insufficient validation of attachment content in Roundcube Webmail's image type conversion handling when passing attachments to ImageMagick. A remote attacker can supply a crafted attachment for image conversion to expose the image processor to potentially unsafe input.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.21, 1.7.6