CVE-2020-12641: Roundcube Webmail OS command injection via image conversion path settings

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, active inclusion in CISA KEV, very high EPSS probability, and public exploit code make this an urgent patch-first issue.

What it is

Roundcube Webmail before 1.4.4 passes the im_convert_path and im_identify_path configuration settings to a shell without sanitization in rcube_image.php, allowing shell metacharacters to be injected. An attacker who can influence those settings can execute arbitrary OS commands on the mail server. The flaw is rated critical and is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

Successful exploitation gives the attacker arbitrary command execution with the privileges of the web server process, enabling full compromise of the Roundcube host and any data it can reach. This can lead to mail data theft, lateral movement, and persistent access.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required per the CVSS vector, but exploitation depends on the ability to set or influence the im_convert_path or im_identify_path configuration values. In practice this means an attacker needs a path to modify those settings, such as a separate configuration flaw or administrative access, which the record does not detail.

Exploitation

CVE-2020-12641 is in CISA's KEV catalog with a due date of 2023-07-13, and EPSS shows a 30-day probability of 0.84336 (99.685th percentile). A public exploit reference is listed, and no ransomware campaign use is documented.

What to do

• Upgrade Roundcube Webmail to 1.4.4 or later (or the corresponding fixed 1.3.11 / 1.2.10 releases) immediately.
• If immediate upgrade is not possible, restrict access to Roundcube administration and configuration interfaces to trusted networks and accounts.
• Audit im_convert_path and im_identify_path settings for unexpected or attacker-controlled values and reset them to trusted binaries.
• Apply vendor patches for openSUSE backports and Leap packages where Roundcube is bundled.
• Monitor for unexpected child processes spawned by the web server user, especially ImageMagick-related binaries.

Detection

• Search web server and Roundcube logs for requests to rcube_image.php with unusual parameters or shell metacharacters.
• Monitor process creation events where the web server user spawns shells or unexpected commands (e.g., sh, bash, convert, identify).
• Alert on changes to Roundcube configuration files, particularly im_convert_path and im_identify_path.
• Correlate outbound network connections from the Roundcube host with process execution by the web server account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.