VULNERABILITY INTELLIGENCE
CVE-2025-49113
CVSS score9.9 CRITICAL
EPSS probability99.49%
CISA KEVKnown exploited vulnerability
Published2025-06-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Known Exploited Vulnerability
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Vendor / product: Roundcube / Webmail
Description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Weakness classification
- cve@mitre.org: CWE-502
- nvd@nist.gov: CWE-502
Primary references
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Patch
- cve@mitre.org — Patch
- cve@mitre.org — Patch
- cve@mitre.org — Issue Tracking
- cve@mitre.org — Release Notes
- cve@mitre.org — Release Notes
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Exploit, Mitigation, Third Party Advisory
- cve@mitre.org — Exploit, Mitigation, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory