Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 2, 2025 |
| Debian | — | Upgrade roundcube | Jun 3, 2025 | Jun 2, 2025 |
| Freebsd | — | Upgrade roundcube-php83Upgrade roundcube-php82Upgrade roundcube-php84Upgrade roundcube-php81 | Jun 4, 2025 | Jun 3, 2025 |
| Ubuntu | — | Upgrade roundcubeUpgrade roundcube-coreUpgrade roundcube (Ubuntu Pro)Upgrade roundcube-core (Ubuntu Pro)Upgrade roundcube-plugins (Ubuntu Pro) | Jun 23, 2025 | Jun 2, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub