// tag
Roundcube
Security incidents tagged Roundcube. Newest first.
- incidents
- 1
- live
- 0
- patched
- 1
## 1 Roundcube incident in the last year
through Oct 22, 2026crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore
show 1 older incident1 older incident
February 2026 1
highRoundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerabilitypatched
› Roundcube Webmail patched
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. CISA added CVE-2025-49113, CVE-2025-68461 to the Known Exploited Vulnerabilities catalog on 2026-02-20 based on evidence of active exploitation.
open incident →CVE-2025-49113 · CVE-2025-68461
