CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

References

Affected packages

Git / github.com/roundcube/roundcubemail

Affected ranges

Type

GIT

Repo

https://github.com/roundcube/roundcubemail

Events

Introduced

Fixed

87380372b6d94f9c90bff2402b76aa71351193e1

Introduced

993b888afe29c383bf45c84f17090f4db96367ba

Fixed

2ae7cec1ca7086a93500f05b3810f2cc9a16990f

Fixed

0376f69e958a8fef7f6f09e352c541b4e7729c4d

Fixed

7408f31379666124a39f9cb1018f62bc5e2dc695

Fixed

c50a07d88ca38f018a0f4a0b008e9a1deb32637e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.10"
        },
        {
            "introduced": "1.6.0"
        },
        {
            "fixed": "1.6.11"
        }
    ]
}

Affected versions

0.*

0.7.4

0.8.6

0.9-rc2

1.*

1.0.0

1.0.1

1.0.10

1.0.11

1.0.12

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1-beta

1.1-rc

1.1.0

1.1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2-beta

1.2-rc

1.2.0

1.2.1

1.2.10

1.2.11

1.2.12

1.2.13

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3-beta

1.3-rc

1.3.0

1.3.1

1.3.10

1.3.11

1.3.12

1.3.13

1.3.14

1.3.15

1.3.16

1.3.17

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4-beta

1.4-rc1

1.4-rc2

1.4.0

1.4.1

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.15

1.4.16

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5-beta

1.5-rc

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6-beta

1.6-rc

1.6.0

1.6.1

1.6.10

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7-beta

1.7-beta2

1.7-rc

1.7-rc2

1.7-rc3

1.7-rc4

1.7-rc5

1.7-rc6

v0.*

v0.1-beta2

v0.1-rc1

v0.1-rc1@582

v0.1-rc2

v0.1-rc2@900

v0.1-stable

v0.1-stable@1183

v0.1.1

v0.1.1@1258

v0.2-alpha

v0.2-alpha@1499

v0.2-beta

v0.2-beta@1877

v0.2-beta@1878

v0.2-stable

v0.2-stable@2204

v0.2.1

v0.2.1@2348

v0.2.2

v0.2.2@2481

v0.2.2@2495

v0.3-beta

v0.3-beta@2799

v0.3-rc1

v0.3-stable

v0.3-stable@2921

v0.3.1

v0.3.1@3081

v0.4-beta

v0.4-beta@3548

v0.4.1

v0.4.1@4045

v0.4.2

v0.4.2@4050

v0.5

v0.5-beta

v0.5-beta@4347

v0.5-rc

v0.5-rc@4349

v0.5.1

v0.5.1@4518

v0.5.2

v0.5.2@4679

v0.5.3

v0.5.3@4832

v0.5.4

v0.5.4@5062

v0.5.4@5065

v0.5@4408

v0.6

v0.6-beta

v0.6-rc

v0.7

v0.7-beta1

v0.7-beta2

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8-beta

v0.8-rc

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.9-beta

v0.9-rc

v0.9-rc2

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v1.*

v1.0-beta

v1.0-rc

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49113.json"