CVE-2025-49113

# CVE-2025-49113: Roundcube Webmail Authenticated RCE **What it is:** Roundcube Webmail fails to validate the `_from` parameter in `program/actions/settings/upload.php`, allowing deserialization of untrusted data. An authenticated attacker can craft a malicious request to execute arbitrary code on the server. **Impact:** Any user with valid Roundcube credentials can achieve remote code execution with the privileges of the web server process, leading to full system compromise, data exfiltration, or lateral movement within your mail infrastructure. **Action required:** Update Roundcube to the patched version immediately. If patched versions are unavailable, implement WAF rules to block requests with suspicious `_from` parameter values in the upload.php endpoint, and audit access logs for exploitation attempts. Restrict Roundcube access to trusted networks pending remediation.