CVE-2020-12640: Opensuse Backports Sle

Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days.

Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

Affected products

• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Roundcube Webmail: from 1.2.0, before 1.2.10 (fixed in 1.2.10); from 1.3.0, before 1.3.11 (fixed in 1.3.11); from 1.4.0, before 1.4.4 (fixed in 1.4.4)

Published 2020-05-04. Last modified 2026-06-17.