CVE-2025-49113

Published Jun 2, 2025

Last updated 4 months ago

Exploit known CVSS critical 9.9

Roundcube Webmail

web application

Server

Rdp

Mobile device

SMTP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-49113 is a remote code execution vulnerability affecting Roundcube Webmail versions before 1.5.10 and 1.6.x before 1.6.11. It stems from the insufficient validation of the `_from` parameter in the `program/actions/settings/upload.php` file. This lack of validation allows for PHP Object Deserialization, potentially enabling authenticated users to execute arbitrary code on the Roundcube Webmail server. The vulnerability has been addressed in Roundcube Webmail versions 1.5.10 and 1.6.11.

Description: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Source: cve@mitre.org
NVD status: Analyzed
Products: webmail, debian_linux

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Exploit added on: Feb 20, 2026
Exploit action due: Mar 13, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-502
nvd@nist.gov: CWE-502

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 5

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AAD2AF8E-DC67-45E3-ABC2-872B771C88C5",
            "versionEndExcluding": "1.5.10",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5DA16DB4-CE88-4E84-BBD6-2A749FFDA43D",
            "versionEndExcluding": "1.6.11",
            "versionStartIncluding": "1.6.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.