CVE-2025-49113: critical vulnerability in Roundcube Webmail
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Roundcube Webmail has a security flaw that allows logged-in users to run harmful code on the server by sending a specially crafted request. This happens because the application doesn't check the _from URL parameter properly before processing it.
The vulnerability exists in program/actions/settings/upload.php where the _from parameter undergoes unsafe PHP object deserialization without validation. An authenticated attacker can exploit this to achieve remote code execution by crafting a malicious serialized object payload. This affects Roundcube versions before 1.5.10 and 1.6.x before 1.6.11.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.