GitHub Advisoryadvisory · Packagist

GHSA-8j8w-wwqc-x596 Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

CRITICAL Published 2025-06-02 Modified 2026-02-20 Official page ↗
Aliases
CVE-2025-49113
Ecosystem
Packagist
Packages
roundcube/roundcubemail
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2025-06-06

Affected packages

• Packagist roundcube/roundcubemail: < 1.5.10 → fixed in 1.5.10 • Packagist roundcube/roundcubemail: >= 1.6.0, < 1.6.11 → fixed in 1.6.11

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Related

Alias · CVE (1)

  • CVE-2025-49113 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References