Roundcube Webmail prior to version 1.6.20 and any 1.7.x release before 1.7.5 accepts SVG and EPS files as contact photo uploads and forwards them to ImageMagick for resizing. These vector graphics formats can reference external resources and invoke ImageMagick delegates during processing. The lack of type validation allows an attacker to upload a crafted SVG or EPS that triggers delegate execution, resulting in arbitrary code execution on the server. The weakness is identified as a use of an unsafe file type that can lead to remote code execution (CWE‑434) and misuse of ImageMagick delegates (CWE‑829).

Roundcube Webmail versions earlier than 1.6.20 and any 1.7.x release before 1.7.5 are affected. The problem was resolved in the 1.6.20 release and the 1.7.5 release, which removed SVG and EPS from the accepted image types.

The CVSS score of 8.3 indicates high severity, while the EPSS score of <1% reflects a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no publicly documented active exploitation. The likely attack vector is an authenticated user or a legitimate contact uploader who can submit a malicious SVG or EPS file. Successful exploitation would allow remote code execution on the hosting system and could compromise confidentiality, integrity, or availability.