CVE-2020-12641

Roundcube Webmail versions before 1.4.4 allow attackers to run malicious code by injecting shell commands through image conversion settings. This is critical because the vulnerable settings are often controlled or influenced by administrators, giving attackers a direct path to execute arbitrary commands on the server.

CWE-78 command injection vulnerability in rcube_image.php exploits unsanitized shell metacharacters in the im_convert_path or im_identify_path configuration parameters. An attacker with ability to modify these settings or influence their values can inject arbitrary shell commands that execute with the privileges of the web server process, leading to complete system compromise.