CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Other sources
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RoundCube Webmailto a version that resolves this vulnerability.Fixed in 1.5.10 - Upgrade
Upgrade
RoundCube Webmailto a version that resolves this vulnerability.Fixed in 1.6.11 - Configuration
Validate the _from parameter in program/actions/settings/upload.php to prevent PHP object deserialization from untrusted URL input.
RoundCube Webmail (program/actions/settings/upload.php) _from URL parameter validation = validated
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49113?
The severity of CVE-2025-49113 is considered critical due to its potential for remote code execution.
How do I fix CVE-2025-49113?
To fix CVE-2025-49113, upgrade Roundcube Webmail to version 1.5.10 or 1.6.11 or later.
Who is affected by CVE-2025-49113?
CVE-2025-49113 affects users of Roundcube Webmail versions prior to 1.5.10 and 1.6.x before 1.6.11.
What causes the vulnerability CVE-2025-49113?
CVE-2025-49113 is caused by the lack of validation for the _from parameter in the upload.php script in Roundcube Webmail.
Can CVE-2025-49113 be exploited by unauthenticated users?
No, CVE-2025-49113 requires authentication to exploit, making it a concern for authenticated users.