CVE-2025-49113 — RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Description

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

Need help remediating this vulnerability?

Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.

Talk to an engineer