dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 13 Jul 2023.
WebmailApplication · Roundcube

CVE-2020-12641

CRITICAL · 9.8 CVSS v3.1 Published 2020-05-04
Fix available
A fix is available. Upgrade to 1.2.10 / 1.3.11 or later.
See remediation →
100/100
Remediation priority · Urgent
In the wild High EPSS Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is a command injection vulnerability in Roundcube Webmail's image processing component (rcube_image.php). The application allows configuration of paths to ImageMagick utilities (im_convert_path and im_identify_path) without sanitizing shell metacharacters, enabling remote attackers to inject and execute arbitrary OS commands by providing malicious values in these configuration settings.

MitigationUpgrade to Roundcube Webmail version 1.4.4 or later, which contains the fix for proper input validation. If immediate upgrade is not feasible, ensure configuration files for im_convert_path and im_identify_path do not contain user-controlled values and implement strict allow-listing of path characters.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
WebmailApplication
Affected:>= 1.2.0, < 1.2.10>= 1.3.0, < 1.3.11>= 1.4.0, < 1.4.4
Backports SleApplication
Affected:= 15.0
LeapOperating system
Affected:= 15.1= 15.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Roundcube Webmail version
    Check the version file (typically in program/include or doc/INSTALL) or look for a version identifier in the main PHP files. Alternatively, access the web interface login page which may display version info in the footer.
    Affected if Version is 1.2.0 through 1.2.9, 1.3.0 through 1.3.10, or 1.4.0 through 1.4.3.
  2. Locate Roundcube configuration file
    Find the main configuration file, typically located at config/config.inc.php in the Roundcube installation directory.
    Affected if The configuration file exists and is readable.
  3. Check for ImageMagick path settings
    Inspect the configuration file for im_convert_path and im_identify_path settings. These may appear as $config['im_convert_path'] and $config['im_identify_path'].
    Affected if Either im_convert_path or im_identify_path is defined in the configuration.
  4. Verify ImageMagick integration is enabled
    Confirm that the im_convert_path or im_identify_path settings point to actual ImageMagick utility paths (commonly 'convert' or full paths like '/usr/bin/convert'). The vulnerability only applies when ImageMagick integration is configured.
    Affected if The settings contain paths to ImageMagick binaries and are actively used by the application.
  5. Inspect path values for shell metacharacters
    Examine the im_convert_path and im_identify_path values in the configuration file. Look for characters such as semicolons (;), pipes (|), ampersands (&), backticks (`), dollar signs ($), quotes, or other shell metacharacters that could enable command injection.
    Affected if The configured paths contain shell metacharacters that could be exploited for arbitrary code execution.

You are affected if your Roundcube version is in the vulnerable range AND the im_convert_path or im_identify_path configuration settings are defined AND those settings contain shell metacharacters that could be exploited.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.2.10 / 1.3.11 / 1.4.4 or later
Fixed in 1.2.101.3.111.4.4
Vendor patch github.com →
Interim mitigation

Upgrade to Roundcube Webmail version 1.4.4 or later, which contains the fix for proper input validation. If immediate upgrade is not feasible, ensure configuration files for im_convert_path and im_identify_path do not contain user-controlled values and implement strict allow-listing of path characters.

Recommended fix High confidence

1.4.4 or later (or 1.2.10+ / 1.3.11+ depending on your branch)

  1. 1. Identify current Roundcube Webmail version by checking the version file or the login page footer
  2. 2. Create a complete backup of the Roundcube installation directory and database
  3. 3. Download the latest stable version from the official Roundcube repository (roundcube.net) - recommended version 1.4.4 or later
  4. 4. Extract the new version to a temporary directory
  5. 5. Replace the existing Roundcube files with the new version, preserving the config/ directory and any custom plugins
  6. 6. Verify that the configuration files (especially config.php) are properly maintained
  7. 7. Clear any cached files in the temp/ and cache/ directories
  8. 8. Test that the webmail interface loads correctly and login works
Caveat Minor - review changelog for deprecations; ensure custom plugins are compatible with the target version

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Webmail Exploited in the wild — priority engagement
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing2.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,420
Get it fixed fast

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-12641 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-12641 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data