CVE-2025-49113
Roundcube Webmail PHP Object Deserialization Vulnerability
Description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
INFO
Published Date :
June 2, 2025, 5:15 a.m.
Last Modified :
June 12, 2025, 5:15 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
6.0
Exploitability Score :
3.1
Public PoC/Exploit Available at Github
CVE-2025-49113 has a 26 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-49113.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Shell
None
A powerful Python scanner to detect CVE-2025-49113 vulnerability in Roundcube Webmail. Developed by Issam Junior (@issamiso).
Python
None
PHP Shell
Explicação + Lab no THM
CVE-2025-49113
PHP Shell
Explicação+ WriteUp do Lab Tryhackme
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
cve cve-2025 cve-exploit cve-scanning cve-2025-49113
Python
Proof-of-concept to CVE-2025-49113
PHP Python
Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113).
PHP
CVE-2025-49113 exploit
PHP
None
PHP
None
Shell PHP
CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserialization
Detection for CVE-2025-49113
roundcube zeroday
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-49113 vulnerability anywhere in the article.
-
europa.eu
Cyber Brief 25-07 - June 2025
Cyber Brief (June 2025)July 1, 2025 - Version: 1TLP:CLEARExecutive summaryWe analysed 277 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, the EU adopted a bluep ... Read more
-
Cyber Security News
Email Hosting Provider Cock.li Hacked – 1 Million Email Addresses Stolen
A major security breach at email hosting provider Cock[.]li has compromised personal data from over one million users, the company announced in an official statement. The incident specifically targete ... Read more
-
BleepingComputer
Hacker steals 1 million Cock.li user records in webmail data breach
Email hosting provider Cock.li has confirmed it suffered a data breach after threat actors exploited flaws in its now-retired Roundcube webmail platform to steal over a million user records. The incid ... Read more
-
Dark Reading
PoC Code Escalates Roundcube Vuln Threat
Source: Mircea Maties via ShutterstockThe threat associated with a critical decade-old remote code execution vulnerability in Roundcube webmail has increased sharply in recent days, with proof-of-conc ... Read more
-
Help Net Security
Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016)
Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. What is Wazuh? Wazuh is a p ... Read more
-
Cyber Security News
84,000+ Roundcube Webmail Installation Vulnerable to Remote Code Execution Attacks
A critical security vulnerability affecting Roundcube webmail installations has exposed over 84,000 systems worldwide to remote code execution attacks. The vulnerability, tracked as CVE-2025-49113, al ... Read more
-
security.nl
85.000 RoundCube-mailservers bevatten actief misbruikt RCE-lek
Wereldwijd zijn er ruim 85.000 RoundCube-mailservers die een actief misbruikte kwetsbaarheid bevatten die remote code execution (RCE) mogelijk maakt, waarvan meer dan zeventienhonderd in Nederland. Da ... Read more
-
BleepingComputer
Over 84,000 Roundcube instances vulnerable to actively exploited flaw
Over 84,000 Roundcube webmail installations are vulnerable to CVE-2025-49113, a critical remote code execution (RCE) flaw with a public exploit. The flaw, which impacts Roundcube versions 1.1.0 throug ... Read more
-
Help Net Security
Roundcube RCE: Dark web activity signals imminent attacks (CVE-2025-49113)
With an exploit for a critical Roundcube vulnerability (CVE-2025-49113) being offered for sale on underground forums and a PoC exploit having been made public, attacks exploiting the flaw are incoming ... Read more
-
Daily CyberSecurity
UNC1151 Exploits Roundcube Flaw in Spear Phishing Attack
CERT Polska has sounded the alarm after uncovering a spear phishing campaign that targeted Polish organizations using a critical webmail vulnerability. The campaign is linked to the UNC1151 APT group, ... Read more
-
Cyber Security News
Hackers Exploiting Roundcube Vulnerability to Steal User Credentials
A sophisticated spear phishing campaign targeting Polish organizations, where threat actors successfully exploited the CVE-2024-42009 vulnerability in Roundcube webmail systems. The attack enables Jav ... Read more
-
security.nl
Kritiek RoundCube-lek maakt remote code execution op mailserver mogelijk
Een kritieke kwetsbaarheid in RoundCube maakt remote code execution op mailservers mogelijk. Een beveiligingsupdate is beschikbaar gemaakt en organisaties worden opgeroepen om die meteen te installere ... Read more
-
BleepingComputer
Hacker selling critical Roundcube webmail exploit as tech info disclosed
Hackers are likely starting to exploit CVE-2025-49113, a critical vulnerability in the widely used Roundcube open-source webmail application that allows remote execution. The security issue has been p ... Read more
-
cert.pl
UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign
CERT Polska has observed a spear phishing campaign targeting Polish entities this week. The threat actor attempted to exploit the CVE-2024-42009 vulnerability, which allows JavaScript code to be execu ... Read more
-
Daily CyberSecurity
CVE-2025-49113: Roundcube RCE Exploit Unveiled—The Swiss Army Knife of Webmail Just Got a Weaponized Blade
In a stunningly fast-moving sequence of events, a serious vulnerability in the widely-used Roundcube webmail client—CVE-2025-49113—has been disclosed early by security researcher Kirill Firsov, founde ... Read more
-
Daily CyberSecurity
Cisco Patches Two Vulnerabilities in CCP and ISE: Proof-of-Concept Exploits Publicly Available
Cisco has issued advisories for two newly disclosed vulnerabilities affecting widely used enterprise software: Cisco Customer Collaboration Platform (CCP) and Cisco Identity Services Engine (ISE). The ... Read more
-
Cyber Security News
10-Year-Old Roundcube RCE Vulnerability Let Attackers Execute Malicious Code
A decade-old critical security vulnerability has been discovered in Roundcube Webmail that could allow authenticated attackers to execute arbitrary code on vulnerable systems, potentially affecting mi ... Read more
-
The Hacker News
Critical 10-Year-Old Roundcube Webmail Bug Allows Authenticated Users Run Malicious Code
Email Security / Vulnerability Cybersecurity researchers have disclosed details of a critical security flaw in the Roundcube webmail software that has gone unnoticed for a decade and could be exploite ... Read more
The following table lists the changes that have been made to the
CVE-2025-49113 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jun. 12, 2025
Action Type Old Value New Value Added Reference https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script Added Reference https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jun. 09, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jun. 02, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/06/02/3 -
CVE Modified by [email protected]
Jun. 02, 2025
Action Type Old Value New Value Added Reference https://fearsoff.org/research/roundcube -
New CVE Received by [email protected]
Jun. 02, 2025
Action Type Old Value New Value Added Description Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-502 Added Reference https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d Added Reference https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695 Added Reference https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e Added Reference https://github.com/roundcube/roundcubemail/pull/9865 Added Reference https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 Added Reference https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 Added Reference https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-49113 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-49113
weaknesses.