CVE-2025-49113

9.9 CRITICAL

Published: June 02, 2025 Modified: December 22, 2025

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://fearsoff.org/research/roundcube

Source: cve@mitre.org

Third Party Advisory

https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d

Source: cve@mitre.org

Patch

https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695

Source: cve@mitre.org

Patch

https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e

Source: cve@mitre.org

Patch

https://github.com/roundcube/roundcubemail/pull/9865

Source: cve@mitre.org

Issue Tracking

https://github.com/roundcube/roundcubemail/releases/tag/1.5.10

Source: cve@mitre.org

Release Notes

https://github.com/roundcube/roundcubemail/releases/tag/1.6.11

Source: cve@mitre.org

Release Notes

https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10

Source: cve@mitre.org

Vendor Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script

Source: cve@mitre.org

Exploit Mitigation Third Party Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection

Source: cve@mitre.org

Exploit Mitigation Third Party Advisory

http://www.openwall.com/lists/oss-security/2025/06/02/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

12 reference(s) from NVD

Quick Stats

CVSS v3 Score

9.9 / 10.0

EPSS (Exploit Probability)

91.8%

100th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-502

Affected Vendors

roundcube debian

Related CVEs