CVE-2020-12640

CRITICAL

Roundcube Webmail <1.4.4 - Path Traversal

Title source: llm

Description

Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

Exploits (1)

nomisec WRITEUP

by mbadanoiu · poc

https://github.com/mbadanoiu/CVE-2020-12640

View Code ZIP pw:eip

References (7)

[Release Notes, Third Party Advisory] https://github.com/roundcube/roundcubemail/releases/tag/1.4.4

[Release Notes, Third Party Advisory] https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4

[Release Notes, Vendor Advisory] https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10

[Patch, Third Party Advisory] https://github.com/roundcube/roundcubemail/commit/814eadb699e8576ce3a78f21e95bf69a7c7b3794

[Exploit, Third Party Advisory] https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube

[Third Party Advisory] https://security.gentoo.org/glsa/202007-41

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html

Scores

CVSS v3 9.8

EPSS 0.2266

EPSS Percentile 95.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (4)

opensuse/backports_sle 15.0 sp1 (2 CPE variants)

opensuse/leap 15.1

opensuse/leap 15.2

roundcube/webmail 1.2.0 - 1.2.10

Published May 04, 2020

Tracked Since Feb 18, 2026