CVE-2020-12641: Roundcube Webmail Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-06-22. EPSS: 84.5% chance of exploitation in the next 30 days.

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Affected products

• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Roundcube Webmail: from 1.2.0, before 1.2.10 (fixed in 1.2.10); from 1.3.0, before 1.3.11 (fixed in 1.3.11); from 1.4.0, before 1.4.4 (fixed in 1.4.4)

Published 2020-05-04. Last modified 2026-06-17.