CVE-2025-49113

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.5.10 and 1.6.x prior to 1.6.11

Description Roundcube Webmail contains a PHP Object Deserialization vulnerability in the from parameter of a URL, potentially allowing a remote attacker to execute arbitrary code. This vulnerability (CVE-2025-49113) has a CVSS score of 9.9 and is actively being exploited. Over 84,000 servers are estimated to be vulnerable, with reports of exploitation occurring in the wild and proof-of-concept exploits publicly available. The vulnerability allows authenticated users to execute code, and has been observed being exploited by threat actors. The vulnerability has been present for approximately 10 years.

Recommendations Update Roundcube to version 1.5.10 or later, or to version 1.6.11 or later.