{"id":"CVE-2020-12641","kind":"vulnerability","aliases":["CVE-2020-12641"],"related":[],"title":"rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell…","description":"Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Roundcube Webmail, a web mail client, has a remote code execution flaw: shell metacharacters in the im_convert_path or im_identify_path configuration setting are passed to a shell. An attacker who can set those values can run arbitrary commands on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-06-22T00:00:00+00:00","products":[{"name":"Roundcube Roundcube Webmail","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.2.10"],"affected":">= 1.2.0, < 1.2.10","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.3.11"],"affected":">= 1.3.0, < 1.3.11","ecosystem":"vendor"},{"name":"roundcube webmail","fixed":["1.4.4"],"affected":">= 1.4.0, < 1.4.4","ecosystem":"vendor"},{"name":"opensuse backports sle","fixed":[],"affected":"= 15.0","ecosystem":"vendor"},{"name":"opensuse leap","fixed":[],"affected":"= 15.1","ecosystem":"vendor"},{"name":"opensuse leap","fixed":[],"affected":"= 15.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","mail","package","php","roundcube","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Look at the Roundcube config file (config/config.inc.php) for im_convert_path and im_identify_path; unknown whether the sources give a version check.","fix":"Update Roundcube Webmail to a fixed release per vendor instructions (CISA KEV required action); exact fixed version unknown from the sources.","status":"open","published_at":"2020-05-04T15:15:14+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:36+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:06:36Z","model":"claude-haiku-5-5","output":{"fix":"Update Roundcube Webmail to a fixed release per vendor instructions (CISA KEV required action); exact fixed version unknown from the sources.","reach":"network","impact":"high","summary":"Roundcube Webmail, a web mail client, has a remote code execution flaw: shell metacharacters in the im_convert_path or im_identify_path configuration setting are passed to a shell. An attacker who can set those values can run arbitrary commands on the server.","category":"package","who_cares":["roundcube","self-hosted","php","mail"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands on the mail server.","analyst_note":"Confirm fixed version and whether exploitation requires admin access to settings, using the vendor advisory and the CISA KEV entry.","how_to_check":"Look at the Roundcube config file (config/config.inc.php) for im_convert_path and im_identify_path; unknown whether the sources give a version check.","needs_analyst":true,"not_affected_if":["managed-hosting","default-config"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":2813,"output_tokens":407,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12641':17A,20A '-2020':16A,19A '1.4.4':6A 'action':120C 'allow':7A,98C 'appli':121C 'arbitrari':11A,84B 'attack':8A,76B,99C 'backports':31A 'cisa':118C 'client':50B 'code':12A,54B,94C,102C 'command':85B 'configur':68B,108C 'contain':91C 'convert':62B,112C 'cve':15A,18A 'execut':10A,55B,95C,101C 'exploit':37B 'flaw':56B 'host':44B 'identifi':66B,116C 'im':61B,65B,111C,115C 'instruct':125C 'leap':34A,36A 'mail':38B,49B 'metacharact':58B,105C 'opensuse':30A,33A,35A 'packag':39B 'pass':71B 'path':63B,67B,113C,117C 'per':123C 'php':40B 'rcube_image.php':1A 'remot':53B,93C 'requir':119C 'roundcub':3A,41B,45B,89C 'roundcube':21A,22A,24A,26A,28A 'run':83B 'self':43B 'self-host':42B 'server':88B 'set':69B,79B,109C 'shell':14A,57B,74B,104C 'sle':32A 'updat':122C 'valu':81B 'vendor':124C 'via':13A,103C 'vulner':96C 'web':48B 'webmail':4A,23A,25A,27A,29A,46B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-05-04T15:15:14+00:00","kev":{"dateAdded":"2023-06-22","dueDate":"2023-07-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-12641","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641","severity":null,"published_at":"2023-06-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-12641","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12641","severity":null,"published_at":"2020-05-04T15:15:14+00:00","modified_at":"2026-06-17T02:52:03+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}