CVE-2025-49113 1

Vulnerability (CVE)

CVE-2025-49113: Round Cube Webmail Deserialization of Untrusted Data Vulnerability

Known Exploited Vulnerabilities CISA KEV Catalog Feb 20, 2026

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

Vulnerabilities & Patching