Critical 1 exploited CVE DLA-4211-1 1 CVE

roundcube - security update

Published Jun 9, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	roundcube	1.4.15+dfsg.1-1+deb11u5

Vulnerabilities 1

Critical 9.9

CVE-2025-49113 Exploited Public exploit Scanner template EPSS 100%

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist

Jun 2, 2025
KEV Feb 20, 2026