CVE-2020-8518: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-8518 affects Horde Groupware Webmail Edition 5.2.22, allowing injection of arbitrary PHP code via CSV data, which can lead to remote code execution. The vulnerability was discovered in early 2020 and affects the Horde Data API versions 2.1.4 and below (NVD, CVE).

The vulnerability is classified as a Code Injection vulnerability (CWE-94) with a CVSS v3.1 Base Score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability exists in the CSV import/export functionality of the Horde Data API, where unescaped strings in CSV data can lead to code execution (NVD).

If exploited, this vulnerability allows attackers to execute arbitrary PHP code on the target system, potentially leading to complete system compromise. The high CVSS score reflects the critical nature of this vulnerability, as it can result in full system access with high impacts on confidentiality, integrity, and availability (NVD).

Multiple vendors have released security updates to address this vulnerability. Debian released version 2.1.0-5+deb8u1 for Debian 8 'Jessie', and updates were also made available for Fedora systems. Users are strongly advised to upgrade to the patched versions (Debian LTS).