CVE-2020-12641
Roundcube Roundcube Webmail
Roundcube Webmail Remote Code Execution Vulnerability
What it is
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
- nvd.nist.gov/vuln/detail/CVE-2020-12641
Description and required action as published by CISA. Full record at NVD.
Other Roundcube entries on the list
- Webmail RoundCube Webmail Cross-site Scripting Vulnerability CVE-2025-68461 · Feb 20, 2026
- Webmail RoundCube Webmail Deserialization of Untrusted Data Vulnerability CVE-2025-49113 · Feb 20, 2026
- Webmail RoundCube Webmail Cross-Site Scripting Vulnerability CVE-2024-42009 · Jun 9, 2025
- Webmail RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability CVE-2024-37383 · Oct 24, 2024
- Webmail Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability CVE-2020-13965 · Jun 26, 2024
- Webmail Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability CVE-2023-43770 · Feb 12, 2024