PT-2025-23462 · Unknown+5 · Roundcube Webmail+5

Firs0V · Published 2019-11-09 · Updated 2026-03-12 · CVE-2025-49113

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.6.11

Description Roundcube Webmail is vulnerable to a critical remote code execution (RCE) vulnerability (CVE-2025-49113) due to improper validation of the from parameter in a URL. This allows authenticated attackers to execute arbitrary code on the server. The vulnerability has been actively exploited and a proof-of-concept exploit is publicly available. The flaw has existed for approximately 10 years and affects a large number of installations, including those bundled with cPanel, Plesk, and ISPConfig. The vulnerability stems from insecure deserialization of untrusted data. Exploitation can lead to full system compromise. Over 84,000 systems are estimated to be vulnerable, and reports indicate active exploitation in the wild. The vulnerability affects versions up to and including 1.6.10.

Recommendations Update Roundcube to version 1.6.11 or later immediately. If updating is not possible, restrict access to the upload.php file and consider disabling the upload functionality until a patch can be applied. Monitor system logs for suspicious activity.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2019-3109

ALT-PU-2020-1898

ALT-PU-2020-2367

ALT-PU-2025-1825

ALT-PU-2025-8283

BDU:2025-06366

CVE-2025-49113

DLA-4211-1

DSA-5934-1

GHSA-8J8W-WWQC-X596

MGASA-2025-0185

USN-7584-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Roundcube Webmail

Ubuntu

References · 340

• 🔥 https://github.com/fearsoff-org/CVE-2025-49113 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection · Exploit
• 🔥 https://exploit-db.com/exploits/52324 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script · Exploit
• https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695 · Patch
• https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d · Patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 · Security Note
• https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e · Patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49113 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5934-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49113 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7584-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49113 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06366 · Security Note