CVE-2025-49113
גבוהה 8.8 מנוצלת בשטח (KEV)
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- RoundCube Webmail Deserialization of Untrusted Data Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
תיאור (מקור, אנגלית)
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
מדדים
- CVSS 3.1
-
8.8 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 97% (אחוזון 100) נכון ל-26/7/2026
- CWE
- CWE-502
מוצרים מושפעים
roundcube: webmail; debian: debian linux
קישורים
- https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 Vendor Advisory
- https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c5… Patch
- https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f… Patch
- https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e… Patch
- https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-scr… ExploitMitigationThird Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-… ExploitMitigationThird Party Advisory
- https://fearsoff.org/research/roundcube Third Party Advisory
- https://github.com/roundcube/roundcubemail/pull/9865 Issue Tracking
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 Release Notes