RCE in Roundcube rcube_image.php via im_convert_path or im_identify_path

Successful exploitation allows arbitrary shell command execution on the Roundcube server in the security context of the web server or Roundcube process. This can enable full compromise of the mail server application environment, theft of mailbox contents and credentials, installation of additional tooling, modification of mail-handling behavior such as forwarding, and use of the host as a pivot for further intrusion or data exfiltration.

If immediate patching is not possible, disable or restrict the vulnerable image-processing functionality that depends on external convert or identify helpers, and ensure the related configuration values are fixed to trusted absolute paths not writable by untrusted users or administrators of lower trust tiers. Harden the web server account, constrain outbound command execution where possible, and monitor for anomalous child-process creation from the webmail application. Restrict administrative access to Roundcube configuration files and validate that no unauthorized changes have been made to image utility path settings.

Upgrade Roundcube Webmail to version 1.4.4 or later. Ensure the application no longer invokes external image-processing utilities through shell-interpreted command strings derived from unsafe configuration values. Review existing Roundcube configuration for im_convert_path and im_identify_path to ensure they contain only legitimate executable paths and no shell metacharacters or appended commands. After patching, inspect the server for signs of post-exploitation and rotate credentials if compromise is suspected.