CVE-2025-49113

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Roundcube	Webmail	< 1.5.10; >= 1.6.0, < 1.6.11

References

https://fearsoff.org/research/roundcubeThird Party Advisory
https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4dPatch
https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695Patch
https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637ePatch
https://github.com/roundcube/roundcubemail/pull/9865Issue Tracking
https://github.com/roundcube/roundcubemail/releases/tag/1.5.10Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11Release Notes
https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10Vendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-scriptExploit, Mitigation, Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detectionExploit, Mitigation, Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/06/02/3Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/06/msg00008.htmlMailing List, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113US Government Resource

Timeline

Published: Jun 2, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 20, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-49129.1A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerabi CVE-2025-491248.4Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacl CVE-2025-491257.5Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted o CVE-2025-491268.8Visionatrix is an AI Media processing tool using ComfyUI. In versions 1.5.0 to before 2.5.1, the /docs/flows endpoint is vulnerable to a Ref CVE-2025-491278.9Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any un CVE-2025-491284.0Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in CVE-2025-49139.8A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. Affected by this issue is some unk CVE-2025-491306.0Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross CVE-2025-491319.9FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational age CVE-2025-4913210.0Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale an CVE-2025-491335.5Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from CVE-2025-491345.3Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user