CVE-2024-37385

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via imconvertpath and imidentifypath. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641...

CVE-2024-37385

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via imconvertpath and imidentifypath. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641...

CVE-2024-37385

Roundcube Webmail versions prior to 1.5.7 and 1.6.x before 1.6.7 on Windows are vulnerable to command injection . The flaw exists within the im_convert_path and im_identify_path functions, originating from an incomplete fix for CVE-2020-12641 . Attackers can exploit this lack of data cleaning mea...