Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-7584-1 1 CVE

roundcube vulnerability

Published Jun 19, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Roundcube Webmail did not properly sanitize the
_from parameter in a URL, leading to PHP Object Deserialization. A remote
attacker could possibly use this issue to execute arbitrary code.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS roundcube 1.6.6+dfsg-2ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS roundcube 1.2~beta+dfsg.1-0ubuntu1+esm6
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm5
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS roundcube 1.4.3+dfsg.1-1ubuntu0.1~esm5
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS roundcube 1.5.0+dfsg.1-2ubuntu0.1~esm4

Vulnerabilities 1

  • Critical 9.9
    CVE-2025-49113 Exploited Public exploit Scanner template EPSS 100%

    Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist
    KEV Feb 20, 2026

References

  • report
    https://ubuntu.com/security/CVE-2025-49113