CVE-2020-12641

Roundcube Webmail versions before 1.4.4 contain an OS command injection flaw (CWE-78) in rcube_image.php: shell metacharacters in the im_convert_path or im_identify_path configuration settings are not escaped before the configured ImageMagick binaries are executed. When image processing is triggered, an attacker who can control those configuration values can append arbitrary shell commands that run with the privileges of the web server user, yielding full remote code execution on the mail server. Successful exploitation can expose stored email, mail credentials, and the underlying host; the flaw is scored 9.8 (critical), with no privileges or user interaction required per the CVSS vector. Any self-hosted Roundcube deployment older than 1.4.4 is affected, including Roundcube packages shipped by openSUSE Leap and openSUSE Backports for SUSE Linux Enterprise. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2023-06-22, EPSS puts the 30-day exploitation probability at ~84%, and headlines note APT28-linked activity targeting government Roundcube servers, including Ukrainian entities.

What to do: Upgrade Roundcube to 1.4.4 or later, or apply the vendor-patched openSUSE Leap / SLE backport packages, as required by the CISA KEV listing (added 2023-06-22). After patching, verify that im_convert_path and im_identify_path settings contain no unescaped metacharacters and review web server logs for injected command activity; given APT28's targeting of government Roundcube servers, prioritize public-sector mail infrastructure for patching and threat hunting.