CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data

What is CVE-2025-49113?

CVE-2025-49113 is a critical unsafe deserialization vulnerability in Debian Debian Linux, published on 2 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Weakness: CWE-502

Which versions are affected by CVE-2025-49113?

4 open source packages ship an affected version, including roundcube/roundcubemail. It affects 2 products.

Products include Debian Debian Linux, Roundcube Webmail.

How do I fix CVE-2025-49113?

Upgrade roundcube/roundcubemail to a fixed version for your release line: 1.5.10 or 1.6.11. US federal agencies must fix it by 13 Mar 2026.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-49113 being exploited?

Yes. Attackers have exploited CVE-2025-49113 in the wild since at least 20 Feb 2026.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 23 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8
• CVE-2022-30333 RARLAB UnRAR Directory Traversal Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2025-48745, DEBIAN-CVE-2025-49113, DLA-4211-1, DSA-5934-1, GHSA-8j8w-wwqc-x596, MGASA-2025-0185 and 2 more.