Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-49113
9.9
CRITICALCVSS v3
Published
June 2, 2025
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
GitHub