# CVE-2020-12641

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

- Page: https://www.vulneraibility.com/cve/CVE-2020-12641
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-06-22; CISA due date 2023-07-13
- EPSS: 84.39% (percentile 99.7)
- Unvetted proof-of-concept code on GitHub: 2 GitHub proofs of concept · 1 Nuclei template (first 2024-04-08)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-04)
- Weakness: CWE-78
- Published: 2020-05-04

## Affected

- roundcube:webmail
- opensuse:backports_sle
- opensuse:leap

## References

- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
- [other] https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
- [other] https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
- [other] https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3
- [other] https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube
- [advisory] https://security.gentoo.org/glsa/202007-41
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.