CVE-2025-49113: Roundcube Webmail Authenticated RCE via PHP Object Deserialization
Summary
CVE-2025-49113: Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization. Affects roundcube/roundcubemail versions >= 1.6.0. No fix is published. How to fix ↓
Also tracked for
- roundcube · Debian:11
The same CVE-2025-49113 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundcube Webmail is a widely-used open-source webmail software that provides a user-friendly interface for managing emails. It supports various features such as address book management, calendar integration, and customizable themes. However, certain versions of Roundcube Webmail are vulnerable to a critical security issue that allows authenticated users to execute arbitrary code remotely, posing significant risks to the integrity and confidentiality of the system.
Vulnerability Detail
The vulnerability arises from improper validation of the '_from' parameter in the 'program/actions/settings/upload.php' file. This oversight allows authenticated users to exploit PHP Object Deserialization, leading to remote code execution (RCE). If an attacker successfully exploits this vulnerability, they can execute arbitrary PHP code on the server, potentially compromising sensitive data and system functionality. The vulnerability affects Roundcube Webmail versions prior to 1.5.10 and 1.6.x before 1.6.11, making it critical for users to update their installations promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the affected upload.php file or to implement additional validation checks on the '_from' parameter to mitigate the risk of exploitation until the software can be updated.
Conclusion
In summary, CVE-2025-49113 is a critical vulnerability in Roundcube Webmail that allows authenticated users to perform remote code execution due to improper validation of input parameters. Users are strongly encouraged to update to the latest versions to mitigate this risk and protect their systems from potential exploitation.
See every vulnerability recorded for roundcube/roundcubemail →
FAQ
CVE-2025-49113 is a vulnerability in Roundcube Webmail that allows authenticated users to execute arbitrary code remotely due to improper validation of a URL parameter.
The vulnerability affects Roundcube Webmail versions prior to 1.5.10 and 1.6.x before 1.6.11.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to compromise the server and access sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundcube/roundcubemail.
