PT-2025-23462 · Unknown+5 · Roundcube Webmail+5

Firs0V · Published 2019-11-09 · Updated 2026-05-22 · CVE-2025-49113

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.10 Roundcube Webmail versions 1.6.x prior to 1.6.11

Description Authenticated users can achieve remote code execution due to improper validation of the from parameter in the URL within the 'program/actions/settings/upload.php' endpoint. This flaw leads to PHP Object Deserialization, a process where untrusted data is used to abuse the logic of an application to execute arbitrary code. It is estimated that over 85,000 servers have been targeted by attacks. Real-world exploitation has been linked to nation-state groups such as APT28 and Winter Vivern, as well as the CapFix group, which targeted industrial and aviation sectors in Russia using a backdoor called CapDoor. Additionally, the vulnerability was used to breach the email provider Cock.li, resulting in the theft of data from over one million users.

Recommendations Update to version 1.5.10 LTS. Update to version 1.6.11. As a temporary workaround, consider disabling file upload functions until the update is applied. Restrict file upload permissions to trusted users only. Monitor web server logs for suspicious requests to the 'program/actions/settings/upload.php' endpoint.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2367

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2025-06366

CVE-2025-49113

DLA-4211-1

DSA-5934-1

GHSA-8J8W-WWQC-X596

MGASA-2025-0185

USN-7584-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Roundcube Webmail

Ubuntu

References · 344

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://exploit-db.com/exploits/52324 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection · Exploit
• https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d · Patch
• https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e · Patch
• https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695 · Patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 · Security Note
• https://osv.dev/vulnerability/DSA-5934-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49113 · Security Note
• https://ubuntu.com/security/CVE-2025-49113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8j8w-wwqc-x596 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49113 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49113 · Vendor Advisory