CVE-2025-49113

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.10 Roundcube Webmail versions 1.6.x prior to 1.6.11

Description Authenticated users can achieve remote code execution due to PHP Object Deserialization, a process where untrusted data is converted back into an object, potentially allowing the execution of arbitrary code. The issue stems from missing input validation of the from parameter within the program/actions/settings/upload.php endpoint. This flaw has been present in the codebase for over a decade and has been actively exploited by nation-state actors, including APT28 and Winter Vivern, to target critical communication systems. Real-world incidents include the compromise of the email provider Cock.li, resulting in the theft of data from over one million users. It is estimated that over 85,000 Roundcube servers have been targeted by attacks.

Recommendations Update Roundcube Webmail to version 1.5.10 LTS. Update Roundcube Webmail to version 1.6.11. As a temporary mitigation, consider temporarily disabling file upload functions until the update is applied. Restrict file upload permissions to trusted users only. Monitor web server logs for suspicious requests directed at the program/actions/settings/upload.php endpoint.