This story appeared in The Register http://www.theregister.co.uk/2016/12/07/roundcube_webmail_flaw/ - My version is 1.2.1
I don’t know if this is old news to the dev and Roundcube has been patched, so just a PSA 
2 Likes
This one should be patched in the next update for sure, threat is real. @JoshData
https://blog.ripstech.com/2016/roundcube-command-execution-via-email/
See this issue.