UBUNTU-CVE-2025-49113
Advisory lineage Upstream: 1 Downstream: 1
Upstream
Downstream
Published: 02 Jun 2025, 05:15
Last modified:23 Feb 2026, 23:21
Vulnerability Summary
Overall Risk (default)
medium
35/100 CVSS Score
8.8 HIGH
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
02 Jun 2025, 05:15
Published
Vulnerability first disclosed
23 Feb 2026, 23:21
Last Modified
Vulnerability information updated
Description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVSS Metrics
- v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Systems
- ubuntu•roundcube
< 1.2~beta+dfsg.1-0ubuntu1+esm6 | < 1.3.6+dfsg.1-1ubuntu0.1~esm5 | < 1.4.3+dfsg.1-1ubuntu0.1~esm5 | < 1.5.0+dfsg.1-2ubuntu0.1~esm4 | < 1.6.6+dfsg-2ubuntu0.1
References (13)
- https://ubuntu.com/security/CVE-2025-49113
- https://www.cve.org/CVERecord?id=CVE-2025-49113
- https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
- https://github.com/roundcube/roundcubemail/pull/9865
- https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
- https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695
- https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e
- http://www.openwall.com/lists/oss-security/2025/06/02/3
- https://fearsoff.org/research/roundcube
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.10
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.11
- https://ubuntu.com/security/notices/USN-7584-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog