Composer Roundcube/roundcubemail vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Composer Roundcube/roundcubemail: 1 record(s), with affected versions and fixes.

CVE-2025-49113 High · 8.8 KEV Urgent · 76 Public exploit CWE-502 Jun 2, 2025

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.