---
id: CVE-2024-37385
title: >-
  Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows
  command injection via im_convert_path and im_identify_path
summary: >-
  Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows
  command injection via im_convert_path and im_identify_path. NOTE: this issue
  exists because of an incomplete fix for CVE-2020-12641.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-77
vendor: roundcube
product: webmail
affected:
  - webmail < 1.5.7
  - 'webmail >= 1.6.0, < 1.6.7'
patched:
  - webmail 1.6.7
published: '2024-06-07'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:20.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-37385'
references:
  - url: >-
      https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f
    label: cve@mitre.org
  - url: 'https://github.com/roundcube/roundcubemail/releases/tag/1.5.7'
    label: cve@mitre.org
  - url: 'https://github.com/roundcube/roundcubemail/releases/tag/1.6.7'
    label: cve@mitre.org
  - url: >-
      https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/roundcube/roundcubemail/releases/tag/1.5.7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/roundcube/roundcubemail/releases/tag/1.6.7'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-08-16T04:01:40.370673Z'
epss: 0.01477
epssPercentile: 0.73953
ingestedAt: '2026-11-05T06:38:03.566Z'
---

## Overview

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

## Affected

- `webmail < 1.5.7`
- `webmail >= 1.6.0, < 1.6.7`

## Remediation

Upgrade past the affected range:

- `webmail 1.6.7`