V
Scaner-VS
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
CVE-2025-49113
ANC
High KEVConfirmedExploit available

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in …

CVSS
8.8
High
EPSS
0.89
p99
Published
2025-01-01
Updated
2026-02-20
Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Tags · CWE
KEV
CWE-502
CAPEC-586
Affected products
Debian_linux
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
2025-01-01
Published
2026-02-20
Added to KEV
2026-02-20
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: L
Low (L)
User Interaction
UI: N
None (N)
Scope
S: U
Unchanged (U)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: H
High (H)
Exploit indicators
EPSS
0.892 · p99
Known exploited (KEV)
Yes
Known exploits — Сканер-ВС
CVE-2025-49113
cisa · https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Enterprise
52324
exploitdb · https://www.exploit-db.com/exploits/52324
Enterprise
Affected products
ProductVendorStatus
Exploited
roundcubeExploited
roundcubeExploited
roundcubeExploited
roundcubeExploited
roundcubeExploited
roundcubeExploited
roundcubeExploited
debian_linux*Exploited
webmail*Exploited
Source databases
ANC
DEB
CVE
UBU
Related vulnerabilities