Roundcube · Roundcube Webmail
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
What it is
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
CISA: Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 13, 2023
- Added to the CISA list
- June 22, 2023
- Published
- May 4, 2020
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 84% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-78
- More details
- NVD · CVE.org · CISA
All references (7)
- https://security.gentoo.org/glsa/202007-41
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
- https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
- https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
- https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube
More exploited flaws from Roundcube
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 22, 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 33% |
| Jun 22, 2023 | Webmail SQL Injection | Roundcube Webmail | Critical 9.8 | 70% |
| Nov 3, 2021 | Webmail File Disclosure | Roundcube Webmail | High 7.8 | 46% |
| Feb 20, 2026 | Deserialization of Untrusted Data | Webmail | Critical 9.9 | 99.7% |
| Feb 20, 2026 | Cross-site Scripting | Webmail | High 7.2 | 27% |
| Jun 9, 2025 | Cross-Site Scripting | Webmail | Critical 9.3 | 83% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 74% |
| Jun 26, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.3 | 77% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.