Vulnerability intelligence

CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVSS Score

9.9

Critical

EPSS — Exploit Probability

98%

Riskier than 100% of all CVEs

Exploitation

Confirmed in the wild

KEV since 2026-02-20

Remediation

Patch available

Federal deadline 2026-03-13

NVD entry Vendor patch PoC / advisory CISA KEV

2 articles across 2 outlets · first covered Jul 13, 2026 · latest Aug 11, 2026

Associated threat actors

UNK_MassTraction Lazarus Group

Coverage timeline

Lazarus hits defence via fake job PDFs, CVE-2026-68820
research.checkpoint.com · Aug 11, 2026
UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments
securityonline.info · Jul 13, 2026