PT-2025-23462 · Unknown +5 · Roundcube Webmail +5

Firs0V · Published 2019-11-09 · Updated 2026-02-20 · CVE-2025-49113

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.6.11

Description Roundcube Webmail is vulnerable to a remote code execution (RCE) vulnerability (CVE-2025-49113) due to improper validation of the

 from

parameter in a URL. This allows authenticated attackers to execute arbitrary code via PHP object deserialization. The vulnerability has been actively exploited, with a proof-of-concept (PoC) exploit available. Over 84,000 instances are estimated to be vulnerable. The vulnerability affects versions 1.1.0 through 1.6.10 and has been present for approximately 10 years. Exploitation can lead to full system compromise.

Recommendations Update Roundcube to version 1.6.11 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2367

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2025-06366

CVE-2025-49113

DLA-4211-1

DSA-5934-1

GHSA-8J8W-WWQC-X596

MGASA-2025-0185

USN-7584-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Roundcube Webmail

Ubuntu

References · 286

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection · Exploit
• https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695 · Patch
• https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d · Patch
• https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e · Patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 · Security Note
• https://osv.dev/vulnerability/DLA-4211-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7584-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0185.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-49113 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0185 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8j8w-wwqc-x596 · Vendor Advisory