Skip to content

PatchFirst · Latest vulnerabilities

roundcube vulnerabilities

Vulnerabilities published for roundcube in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1

CVE-2025-49113
Critical · CVSS 9.9EPSS 99.71%In KEVPublic exploitFix available
CVE-2025-49113
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
roundcube Operating systems
- Update to 1.6.6+dfsg-2ubuntu0.1
Published June 2, 2025Updated February 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →