Remote Code Execution Vulnerability in Roundcube Webmail
Summary
CVE-2025-49113: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Obj... Affects roundcube across 6 version ranges.
< 1.4.15+dfsg.1-1+deb11u5
< 2ae7cec1ca7086a93500f05b3810f2cc9a16990f
< 0376f69e958a8fef7f6f09e352c541b4e7729c4d
< 7408f31379666124a39f9cb1018f62bc5e2dc695
< 87380372b6d94f9c90bff2402b76aa71351193e1
< c50a07d88ca38f018a0f4a0b008e9a1deb32637e
Fixed in 1.4.15+dfsg.1-1+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundcube Webmail is a widely used open-source webmail software that provides a user-friendly interface for managing emails. It supports various features such as email filtering, address book management, and plugin integration. However, certain versions of Roundcube are vulnerable to a remote code execution flaw due to improper validation of the '_from' parameter in the upload settings, which can lead to serious security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2025-49113, affects Roundcube Webmail versions prior to 1.5.10 and 1.6.x before 1.6.11. It allows authenticated users to exploit the application by sending specially crafted requests that manipulate the '_from' parameter in the URL. This lack of validation can lead to PHP Object Deserialization, enabling attackers to execute arbitrary code on the server, potentially compromising sensitive data and the integrity of the application.
How To Fix
Minimum fixed version
1.4.15+dfsg.1-1+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade roundcubeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Roundcube application to trusted users only. Additionally, implementing web application firewalls (WAF) can help mitigate the risk of exploitation until the software is updated.
Conclusion
The CVE-2025-49113 vulnerability in Roundcube Webmail poses a significant risk of remote code execution for users of affected versions. It is crucial to update to the latest patched versions to safeguard against potential exploits. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for roundcube →
FAQ
CVE-2025-49113 is a vulnerability in Roundcube Webmail that allows remote code execution due to improper validation of the '_from' parameter.
Versions of Roundcube prior to 1.5.10 and 1.6.x before 1.6.11 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the server and sensitive user data.
Yes, restricting access to trusted users and using web application firewalls can help mitigate the risk until the software is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundcube.
