CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

• CWE-502
• CWE-502

• https://fearsoff.org/research/roundcubeThird Party Advisory
• https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4dPatch
• https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695Patch
• https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637ePatch
• https://github.com/roundcube/roundcubemail/pull/9865Issue Tracking
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.10Release Notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.11Release Notes
• https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10Vendor Advisory
• https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-scriptExploit, Mitigation, Third Party Advisory
• https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detectionExploit, Mitigation, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2025/06/02/3Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/06/msg00008.htmlMailing List, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113US Government Resource

Published

Jun 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4909A vulnerability classified as critical was found in SourceCo…7.3
• CVE-2025-49090The Matrix specification before 1.16 (i.e., with a room vers…7.1
• CVE-2025-49091KDE Konsole before 25.04.2 allows remote code execution in a…8.2
• CVE-2025-4910A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-4911A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-49112setDeferredReply in networking.c in Valkey through 8.1.1 has…3.1
• CVE-2025-4912A vulnerability has been found in SourceCodester Student Res…9.1
• CVE-2025-49124Untrusted Search Path vulnerability in Apache Tomcat install…8.4
• CVE-2025-49125Authentication Bypass Using an Alternate Path or Channel vul…7.5
• CVE-2025-49126Visionatrix is an AI Media processing tool using ComfyUI. In…8.8
• CVE-2025-49127Kafbat UI is a web user interface for managing Apache Kafka …8.9
• CVE-2025-49128Jackson-core contains core low-level incremental ("streaming…4