CVE-2025-49113
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.9epss 98%
de la publicación al arma0 días
Publicada en NVD2 jun
1ª PoC12 abr
metasploit2 jun
CISA KEV+263d
probabilidad de explotación
98%top 1% de las CVE
explotación observada
síCISA + VulnCheck
41 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2026-03-13
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Versiones
Afectadas
composer/roundcube/roundcubemail < 1.5.10; composer/roundcube/roundcubemail >= 1.6.0, < 1.6.11
Corregidas en
composer/roundcube/roundcubemail 1.5.10; composer/roundcube/roundcubemail 1.6.11
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Roundcube · WebmailPoCs públicas encontradas — 41
exploitdbwww.exploit-db.com/exploits/52324no verificadogithubgithub.com/fearsoff-org/CVE-2025-49113★ 108githubgithub.com/hakaioffsec/CVE-2025-49113-exploit★ 92githubgithub.com/00xCanelo/CVE-2025-49113★ 8githubgithub.com/BiiTts/Roundcube-CVE-2025-49113★ 6githubgithub.com/Zwique/CVE-2025-49113★ 5githubgithub.com/rxerium/CVE-2025-49113★ 5githubgithub.com/Ademking/CVE-2025-49113-nuclei-template★ 3githubgithub.com/rasool13x/exploit-CVE-2025-49113★ 3githubgithub.com/SyFi/CVE-2025-49113★ 2githubgithub.com/l4f2s4/CVE-2025-49113_exploit_cookies★ 1githubgithub.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP★ 1githubgithub.com/Joelp03/CVE-2025-49113★ 1githubgithub.com/ankitpandey383/roundcube-cve-2025-49113-lab★ 0githubgithub.com/Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-★ 0githubgithub.com/LeakForge/CVE-2025-49113★ 0githubgithub.com/5kr1pt/Roundcube_CVE-2025-49113★ 0githubgithub.com/punitdarji/roundcube-cve-2025-49113★ 0githubgithub.com/hackmelocal/CVE-2025-49113-Simulation★ 0githubgithub.com/CyberQuestor-infosec/CVE-2025-49113-Roundcube_1.6.10★ 0githubgithub.com/AC8999/CVE-2025-49113★ 0githubgithub.com/mooder1/CVE-2025-49113★ 0githubgithub.com/rippsec/CVE-2025-49113-Roundcube-RCE★ 0githubgithub.com/Evillm/CVE-2025-49113-PoC★ 0vulncheckvulncheck.com/xdb/f2cc9a510d73no verificadovulncheckvulncheck.com/xdb/97288c041629no verificadovulncheckvulncheck.com/xdb/907e255a46cbno verificadovulncheckvulncheck.com/xdb/c677c69937f8no verificadovulncheckvulncheck.com/xdb/d329bc052233no verificadovulncheckvulncheck.com/xdb/b56aba012470no verificadovulncheckvulncheck.com/xdb/97b1284b1784no verificadovulncheckvulncheck.com/xdb/b58adaecc268no verificadovulncheckvulncheck.com/xdb/7695cc6dfe09no verificadovulncheckvulncheck.com/xdb/e7fe4d3a4995no verificadovulncheckvulncheck.com/xdb/723747ceedbbno verificadovulncheckvulncheck.com/xdb/33f506cba416no verificadovulncheckvulncheck.com/xdb/75c30f2fa63dno verificadovulncheckvulncheck.com/xdb/e772d119ea95no verificadovulncheckvulncheck.com/xdb/aebffdccd3deno verificadovulncheckvulncheck.com/xdb/59604bbbb3fano verificadovulncheckvulncheck.com/xdb/b037dfabf975no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://fearsoff.org/research/roundcubehttps://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4dhttps://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637ehttps://github.com/roundcube/roundcubemail/pull/9865https://github.com/roundcube/roundcubemail/releases/tag/1.5.10https://github.com/roundcube/roundcubemail/releases/tag/1.6.11https://lists.debian.org/debian-lts-announce/2025/06/msg00008.htmlhttps://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-scripthttps://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection