CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability

RoundCube Webmail has a deserialization of untrusted data vulnerability (a flaw where the program unsafely processes data from users, which can be exploited to run malicious code) in its settings upload feature because a URL parameter called _from is not properly checked. This allows authenticated users (those who have logged in) to execute remote code execution (run commands on the server without owning it), and it is currently being exploited by attackers in real-world attacks.