CVE Watch—

CVE-2025-49113

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

CVSS

—

Sem CVSS

EPSS

99.5%

p100

KEV

SIM

20 de fev. de 2026

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

99.0%EPSS · 30 dias99.7%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Roundcube / Webmail

Vulnerabilidade

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Adicionado ao KEV

20 de fev. de 2026

Corrigir até

13 de mar. de 2026

Uso conhecido em ransomware

Não

Descrição resumida

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

Ação necessária

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49113

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2024-42009—

99.7%

KEV—80RoundCube Webmail Cross-Site Scripting Vulnerability—CVE-2020-13965—

99.5%

KEV—80Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability—CVE-2023-5631—

99.5%

KEV—80Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability—CVE-2024-37383—

99.5%

KEV—80RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability—CVE-2023-43770—

99.2%

KEV—80Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability—CVE-2025-68461—

98.1%

KEV—79RoundCube Webmail Cross-site Scripting Vulnerability—