Vendor

Roundcube

59 known vulnerabilities.

Products

Webmail 58 Roundcubemail 1 roundcube 0

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.9

CVE-2025-49113 Exploited Public exploit EPSS 100%

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist

Jun 2, 2025
KEV Feb 20, 2026