Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

RoundCube Webmail Allows Remote Code Execution via Unvalidated Data

Known exploited Exploitation likelihood: 90%
CVE-2025-49113 CVE-2025-49113 GHSA-8j8w-wwqc-x596
Summary

The RoundCube Webmail application can execute malicious code if an attacker sends a specially crafted email with a URL containing unverified data. This means an attacker could potentially take control of the server. Update to a fixed version of RoundCube to protect your system.

What to do
  • Update roundcube roundcubemail to version 1.5.10.
  • Update roundcube roundcubemail to version 1.6.11.
Affected software
VendorProductAffected versionsFix available
roundcube webmail All versions
roundcube roundcubemail <= 1.5.10 1.5.10
roundcube roundcubemail > 1.6.0 , <= 1.6.11 1.6.11
roundcube webmail <= 1.5.10
roundcube webmail > 1.6.0 , <= 1.6.11
debian debian_linux 11.0
Original title
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Original description
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
Vulnerability type
CWE-502 Deserialization of Untrusted Data
Published: 20 Feb 2026 · Updated: 15 Mar 2026 · First seen: 6 Mar 2026