PT-2020-6925 · Unknown+4 · Roundcube Webmail+4

Mal · Published 2019-10-03 · Updated 2026-03-12 · CVE-2020-12641

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.4.4

Description The issue exists due to the lack of protection of the web page structure in the im convert path and im identify path functions of the rcube image.php file in Roundcube Webmail. This allows a remote attacker to execute arbitrary code via shell metacharacters in a configuration setting for im convert path or im identify path.

Recommendations To resolve the issue, upgrade to version 1.4.4 or later. As a temporary workaround, consider disabling the im convert path and im identify path functions in the rcube image.php file until a patch is available. Restrict access to the rcube image.php file to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2019-2818

ALT-PU-2019-2946

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2097

ALT-PU-2020-2319

ALT-PU-2020-2367

ALT-PU-2020-2518

ALT-PU-2020-2554

ALT-PU-2020-3561

ALT-PU-2020-3566

ALT-PU-2021-3558

ALT-PU-2022-1073

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2023-07518

BIT-ROUNDCUBE-2020-12641

CVE-2020-12641

OPENSUSE-SU-2020:1516-1

OPENSUSE-SU-2020_1516-1

OPENSUSE-SU-2022:10148-1

OPENSUSE-SU-2024:11303-1

USN-5182-1

Affected Products

Alt Linux

Linuxmint

Roundcube Webmail

Suse

Ubuntu

References · 73

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube · Exploit
• https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3 · Patch
• https://ubuntu.com/security/CVE-2020-12625 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12641 · Security Note
• https://ubuntu.com/security/CVE-2020-12640 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12641 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html · Vendor Advisory
• https://security.gentoo.org/glsa/202007-41 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44026 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12641 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:1516-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12641 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5182-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46144 · Vendor Advisory