How to find Roundcube Webmail on your network

Roundcube Webmail versions 1.5 prior to 1.5.10 and 1.6 prior to 1.6.11 are affected by CVE-2025-49113, a critical (CVSS 9.9) authenticated remote code execution vulnerability caused by PHP object deserialization of an unvalidated _from parameter in program/actions/settings/upload.php. The vulnerability has existed for ~10 years and there is evidence of active exploitation in the wild; Roundcube has released updates (1.5.10 and 1.6.11+) and the advisory includes detection guidance and a runZero query to locate potentially impacted assets—administrators should apply patches immediately.