CVE-2020-12641
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jun 22, 2023
- US federal agencies must remediate it by Jul 13, 2023 (BOD 22-01)
- First attack observed 1141 days after disclosure
- Confirmed by sensors, not only by reports
Apply updates per vendor instructions.
Source: CISA KEV · Sep 23, 2026 Sep 22, 2026 Sep 21, 2026 Sep 18, 2026 Sep 17, 2026 Sep 16, 2026
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-78, CWE-78
Vendorsopensuse, roundcube
Affected products
| Vendors | Product | Versions |
|---|---|---|
| roundcube | webmail | < 1.2.10 |
| opensuse | backports sle | 15.0 |
| opensuse | leap | 15.1 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.