GHSA-8j8w-wwqc-x596
GitHub Security Advisory
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
✓ GitHub Reviewed
CRITICAL
Has CVE
Advisory Details
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Affected Packages
Packagist
roundcube/roundcubemail
Affected versions:
0
Packagist
roundcube/roundcubemail
Affected versions:
1.6.0
Related CVEs
Key Information
9.0
/10
Dataset
Last updated: June 14, 2025 6:24 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.