p PatchFirst

CVE-2025-49113

CVE-2025-49113

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVSS 9.9 · Critical · EPSS 99.0% · In KEV · Public exploit · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • webmail

    Versions
    • ≥ 0, < 1.5.10: Affected (semver)
    • ≥ 1.6.0, < 1.6.11: Affected (semver)

    Update to 1.5.10; Update to 1.6.11

  • roundcube Debian:12

    Versions
    • 1.6.1+dfsg-1
    • 1.6.2+dfsg-1
    • 1.6.3+dfsg-1
    • 1.6.3+dfsg-1~deb12u1
    • 1.6.3+dfsg-2
    • 1.6.4+dfsg-1
    • 1.6.4+dfsg-1~deb12u1
    • 1.6.5+dfsg-1
    • 1.6.5+dfsg-1+deb12u2
    • 1.6.5+dfsg-1+deb12u3
    • 1.6.5+dfsg-1+deb12u4
    • 1.6.5+dfsg-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.6.5+dfsg-1+deb12u5

    Update to 1.6.5+dfsg-1+deb12u5

  • roundcube Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.6.11+dfsg-1

    Update to 1.6.11+dfsg-1

  • roundcube Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.6.11+dfsg-1

    Update to 1.6.11+dfsg-1

  • roundcube/roundcubemail Packagist

    Affected ranges
    • ECOSYSTEM: < 1.5.10

    Update to 1.5.10

  • roundcube/roundcubemail Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 1.6.0, < 1.6.11

    Update to 1.6.11

  • roundcube Ubuntu:Pro:16.04:LTS

    Versions
    • 1.1.1+dfsg.1-2
    • 1.1.2+dfsg.1-5
    • 1.1.3+dfsg.1-1
    • 1.1.4+dfsg.1-1
    • 1.2~beta+dfsg.1-0ubuntu1
    • 1.2~beta+dfsg.1-0ubuntu1+esm1
    • 1.2~beta+dfsg.1-0ubuntu1+esm2
    • 1.2~beta+dfsg.1-0ubuntu1+esm3
    • 1.2~beta+dfsg.1-0ubuntu1+esm4
    • 1.2~beta+dfsg.1-0ubuntu1+esm5
    Affected ranges
    • ECOSYSTEM: < 1.2~beta+dfsg.1-0ubuntu1+esm6

    Update to 1.2~beta+dfsg.1-0ubuntu1+esm6

  • roundcube Ubuntu:Pro:18.04:LTS

    Versions
    • 1.3.0+dfsg.1-1
    • 1.3.1+dfsg.1-1
    • 1.3.3+dfsg.1-1
    • 1.3.3+dfsg.1-2
    • 1.3.6+dfsg.1-1
    • 1.3.6+dfsg.1-1ubuntu0.1~esm1
    • 1.3.6+dfsg.1-1ubuntu0.1~esm2
    • 1.3.6+dfsg.1-1ubuntu0.1~esm3
    • 1.3.6+dfsg.1-1ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: < 1.3.6+dfsg.1-1ubuntu0.1~esm5

    Update to 1.3.6+dfsg.1-1ubuntu0.1~esm5

  • roundcube Ubuntu:Pro:20.04:LTS

    Versions
    • 1.3.8+dfsg.1-2
    • 1.3.10+dfsg.1-1
    • 1.4.1+dfsg.1-2
    • 1.4.2+dfsg.1-1
    • 1.4.2+dfsg.1-2
    • 1.4.3+dfsg.1-1
    • 1.4.3+dfsg.1-1ubuntu0.1~esm1
    • 1.4.3+dfsg.1-1ubuntu0.1~esm2
    • 1.4.3+dfsg.1-1ubuntu0.1~esm3
    • 1.4.3+dfsg.1-1ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: < 1.4.3+dfsg.1-1ubuntu0.1~esm5

    Update to 1.4.3+dfsg.1-1ubuntu0.1~esm5

  • roundcube Ubuntu:Pro:22.04:LTS

    Versions
    • 1.4.11+dfsg.1-4
    • 1.5.0+dfsg.1-2
    • 1.5.0+dfsg.1-2ubuntu0.1~esm1
    • 1.5.0+dfsg.1-2ubuntu0.1~esm2
    • 1.5.0+dfsg.1-2ubuntu0.1~esm3
    Affected ranges
    • ECOSYSTEM: < 1.5.0+dfsg.1-2ubuntu0.1~esm4

    Update to 1.5.0+dfsg.1-2ubuntu0.1~esm4

  • roundcube Ubuntu:24.04:LTS

    Versions
    • 1.6.2+dfsg-1
    • 1.6.4+dfsg-1
    • 1.6.5+dfsg-1
    • 1.6.6+dfsg-1
    • 1.6.6+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 1.6.6+dfsg-2ubuntu0.1

    Update to 1.6.6+dfsg-2ubuntu0.1

Original sources

Check your server →