Live › vulnerability › CVE-2020-12641
Go to dashboardRoundcube Webmail, a web mail client, has a remote code execution flaw: shell metacharacters in the im_convert_path or im_identify_path configuration setting are passed to a shell. An attacker who can set those values can run arbitrary commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Roundcube Roundcube Webmail | vendor | – | – |
| roundcube webmail | vendor | >= 1.2.0, < 1.2.10 | 1.2.10 |
| roundcube webmail | vendor | >= 1.3.0, < 1.3.11 | 1.3.11 |
| roundcube webmail | vendor | >= 1.4.0, < 1.4.4 | 1.4.4 |
| opensuse backports sle | vendor | = 15.0 | – |
| opensuse leap | vendor | = 15.1 | – |
| opensuse leap | vendor | = 15.2 | – |
Look at the Roundcube config file (config/config.inc.php) for im_convert_path and im_identify_path; unknown whether the sources give a version check.
Update Roundcube Webmail to a fixed release per vendor instructions (CISA KEV required action); exact fixed version unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-12641")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.