CVE-2020-12640

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.4.4

Description The issue allows attackers to include local files and execute code via directory traversal in a plugin name to "rcube plugin api.php". This can be exploited by providing a malicious plugin name, potentially leading to code execution.

Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "rcube plugin api.php" endpoint to minimize the risk of exploitation.