CVE-2025-49113 log

Source
Severity Critical
Remote Yes
Type Arbitrary code execution
Description 
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Group Package Affected Fixed Severity Status Ticket
AVG-2891 roundcubemail 1.6.10-1 1.6.11-1 Critical Fixed
References 
https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
https://www.cve.org/CVERecord?id=CVE-2025-49113
https://www.openwall.com/lists/oss-security/2025/06/02/3
https://github.com/roundcube/roundcubemail/pull/9865