CVE Watch—

CVE-2020-12641

Roundcube Webmail Remote Code Execution Vulnerability

CVSS

—

No CVSS

EPSS

84.5%

p100

KEV

YES

Jun 22, 2023

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

84.3%EPSS · 30 days84.5%

2026-09-162026-10-14

KEV catalog record

Product

Roundcube / Roundcube Webmail

Vulnerability

Roundcube Webmail Remote Code Execution Vulnerability

Added to KEV

Jun 22, 2023

Remediate by

Jul 13, 2023

Known ransomware use

Summary description

Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Required action

Apply updates per vendor instructions.

Notes

https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10; https://nvd.nist.gov/vuln/detail/CVE-2020-12641

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-44026—

99.4%

KEV—80Roundcube Webmail SQL Injection Vulnerability—CVE-2017-16651—

98.8%

KEV—80Roundcube Webmail File Disclosure Vulnerability—CVE-2020-35730—

98.3%

KEV—80Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability—