Type Vulnerability
RoundCube Webmail contains a deserialisation of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in…
Roundcube · Parser conflict
RoundCube Webmail Unsafe Deserialisation Vulnerability
CVE-2025-49113
What this means
This is rated critical severity (9.9 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Roundcube Webmail and Debian Debian Linux are in your estate, and treat that as the priority.
Full vendor description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Scoring and exploitation
9.9/ 10
CVSS 3.1 base scoreCritical
Exploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~99.5% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Roundcube Webmail
Weaknesses
CWE-502
Affected products ()
- Roundcube Webmail
- Debian Debian Linux
Show the raw CPE strings (2)
- cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References
13 links from the CVE record, grouped by site; the vendor's advisory comes first.
roundcube.net1 linkVendor advisory
- security-updates-1.6.11-and-1.5.10 (opens in a new tab)Vendor Advisory
fearsoff.org1 link
- roundcube (opens in a new tab)Third Party Advisory
github.com6 links
- 0376f69e958a8fef7f6f09e352c541b4e7729c4d (opens in a new tab)Patch
- 7408f31379666124a39f9cb1018f62bc5e2dc695 (opens in a new tab)Patch
- c50a07d88ca38f018a0f4a0b008e9a1deb32637e (opens in a new tab)Patch
Show 3 more from github.com
- 9865 (opens in a new tab)Issue Tracking
- 1.5.10 (opens in a new tab)Release Notes
- 1.6.11 (opens in a new tab)Release Notes
vicarius.io2 links
- cve-2025-49113-roundcube-mitigation-script (opens in a new tab)Exploit · Mitigation · Third Party Advisory
- cve-2025-49113-roundcube-vulnerability-detection (opens in a new tab)Exploit · Mitigation · Third Party Advisory
openwall.com1 link
- 3 (opens in a new tab)Mailing List · Third Party Advisory
lists.debian.org1 link
- msg00008.html (opens in a new tab)Mailing List · Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource