GHSA-q9jx-pp2v-v8xh

Exploit Intelligence

• CVE-2020-12641: Command Injection via “_im_convert_path” Parameter in Roundcube Webmail (github-poc-repo)
• CVE-2020-12641: Command Injection via “_im_convert_path” Parameter in Roundcube Webmail (github-poc-repo)
• MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail (github-poc-repo)
• MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail (github-poc-repo)
• MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail (github-poc)
• MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail (github-poc)
• CVE-2020-12641: Command Injection via “_im_convert_path” Parameter in Roundcube Webmail (github-poc)
• CVE-2020-12641: Command Injection via “_im_convert_path” Parameter in Roundcube Webmail (github-poc)
• kev.json (github-poc)
• kev.json (github-poc)

…and 6 more exploits

Timeline

• CVE Published
• Apr 9, 2026 Security Advisory