CRITICALCVSS 9.9Actively exploited · CISA KEV since 2026-02-20Vulnerability

CVE-2025-49113

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

Properties

Euvd product
Webmail
Vulnerability name
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
First seen
2026-02-21T04:56:23+00:00
Cvss score
9.9
Epss score
0.98972
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-03-13
Euvd assigner
mitre
Retrieved at
2026-10-21T01:24:47+00:00
Exploited euvd since
2026-02-20T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2026-02-20
Euvd base score version
3.1
Score
9.9
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Roundcube, bulwarkmail
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9.9

Related Entities (9)

MENTIONED_IN (4)

→[Campaign]State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit
→[Campaign]Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack
→[Campaign]Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days
→[Campaign]One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation

AFFECTS_PRODUCT (2)

→[Product]cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

DESCRIBES (1)

←[KEVEntry]RoundCube Webmail Deserialization of Untrusted Data Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Deserialization of Untrusted Data

INVOLVES (1)

←[Signal]kev_added · 2026-02-20

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2025-49113 (CVSS 9.9) — Ninja Signal Threat Intelligence | Ninja Signal