Command Injection in Roundcube rcube_image.php

Successful exploitation allows arbitrary code execution in the context of the web server or Roundcube application user. This can enable full compromise of the Roundcube instance, access to stored or processed email data, mailbox theft, server-side persistence, and use of the host as a pivot for further intrusion. Supporting reporting also indicates the vulnerability has been exploited by APT28 to execute shell commands and access or exfiltrate email data.

If immediate patching is not possible, disable or avoid use of the affected external image-processing configuration paths where feasible, and ensure im_convert_path and im_identify_path are hardcoded to trusted absolute paths with no shell expansion characters. Restrict administrative/configuration access, monitor for unexpected process execution from the webmail environment, and apply host-level controls such as least-privilege execution and command execution monitoring to reduce exploitation impact.

Upgrade Roundcube Webmail to version 1.4.4 or later, where this issue is fixed. Review and correct the im_convert_path and im_identify_path configuration values to ensure they reference only legitimate executable paths and do not contain shell metacharacters or attacker-controlled content. Validate that no unsafe local customizations reintroduce shell invocation risks.