CVE-2020-12641 PUBLISHED KEV

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

EPSS 93.13% · 99.8th percentile

Risk Scores

EPSS Score
93.13%
99.8th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSroundcube0, 1.1.1+dfsg.1-2, 1.1.2+dfsg.1-5
Ubuntu:Pro:20.04:LTSroundcube1.4.3+dfsg.1-1, 0, 1.3.8+dfsg.1-2
Ubuntu:Pro:18.04:LTSroundcube0, 1.3.0+dfsg.1-1, 1.3.1+dfsg.1-1

Timeline

References

Open in Interactive Console →