CVE-2025-49113

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Why is this CVE high priority?

CVE is in CISA KEV list

Learn more about Ubuntu priority

Status

Show unmaintained releases

Package	Ubuntu Release	Status
roundcube	25.10 questing	Not affected
	25.04 plucky	Fixed 1.6.10+dfsg-1ubuntu0.1
	24.10 oracular	Fixed 1.6.8+dfsg-2ubuntu0.1
	24.04 LTS noble	Fixed 1.6.6+dfsg-2ubuntu0.1
	22.04 LTS jammy	Fixed 1.5.0+dfsg.1-2ubuntu0.1~esm4
	20.04 LTS focal	Fixed 1.4.3+dfsg.1-1ubuntu0.1~esm5
	18.04 LTS bionic	Fixed 1.3.6+dfsg.1-1ubuntu0.1~esm5
	16.04 LTS xenial	Fixed 1.2~beta+dfsg.1-0ubuntu1+esm6

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

Parameter	Value
Base score	9.9 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-7584-1
Roundcube vulnerability
19 June 2025