{"id":"CVE-2025-49113","published":"2025-06-02T05:15:53Z","modified":"2026-06-17T09:30:47Z","title":"RoundCube Webmail Deserialization of Untrusted Data Vulnerability","vendor":"Roundcube","product":"Webmail","tier":"core","eol":null,"description":{"text":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.","provenance":"source","from":"NVD"},"summary":{"text":"The Roundcube Webmail product contains a deserialization of untrusted data flaw in the _from parameter of program/actions/settings/upload.php, which is not validated before the data is processed, affecting versions before 1.5.10 and 1.6.x before 1.6.11. An attacker who is an authenticated user can remotely exploit this without user interaction to achieve remote code execution via PHP object deserialization, requiring only network access and valid low-privilege credentials.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:11Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99491,"percentile":0.99945,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-02-20","dueDate":"2026-03-13","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49113","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-06-04","exploitedFirstSeen":"2025-06-04","ransomware":true,"evidence":[{"url":"https://fearsoff.org/research/roundcube","date":"2025-06-04"},{"url":"https://cyble.com/blog/weekly-cyble-vulnerability-blog/","date":"2025-06-10"},{"url":"https://x.com/ReyXBF/status/1933555211185819835","date":"2025-06-13"},{"url":"https://falconfeeds.io/blogs/unmasking-handala-iran-cyber-threat-psyops","date":"2025-06-16"},{"url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-23-sep-2025-d9f3b20bdcc7","date":"2025-09-25"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-02-20"},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","date":"2026-02-25"},{"url":"https://ptsecurity.com/about/news/pt-has-recorded-a-new-wave-of-attacks-by-the-capfix-group/","date":"2026-04-08"},{"url":"https://www.rnbo.gov.ua/files/2026/NATIONAL_CYBER_SCC/kiber_2025.pdf","date":"2026-05-12"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://fearsoff.org/research/roundcube","tags":["Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/pull/9865","tags":["Issue Tracking"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.10","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.11","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10","tags":["Vendor Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/02/3","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote exploit of public-facing webmail application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote code execution by authenticated users","start":56,"end":107}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: deserialization yields code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"leading to PHP Object Deserialization","start":202,"end":239}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"roundcube/roundcubemail","vulnerableRanges":["<1.5.10",">=1.6.0, <1.6.11"],"patched":["1.5.10","1.6.11"],"from":["GHSA-8j8w-wwqc-x596"],"provenance":"source"}],"advisories":[{"id":"GHSA-8j8w-wwqc-x596","url":"https://github.com/advisories/GHSA-8j8w-wwqc-x596","severity":"CRITICAL","ecosystem":"Packagist","package":"roundcube/roundcubemail","vulnerableRanges":["<1.5.10"],"patched":["1.5.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8j8w-wwqc-x596","url":"https://github.com/advisories/GHSA-8j8w-wwqc-x596","severity":"CRITICAL","ecosystem":"Packagist","package":"roundcube/roundcubemail","vulnerableRanges":[">=1.6.0, <1.6.11"],"patched":["1.6.11"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-16605","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16605","exploited":true,"exploitedSince":"2026-02-20","provenance":"source"},"exploits":[{"id":52324,"url":"https://www.exploit-db.com/exploits/52324","title":"Roundcube 1.6.10 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2025-06-13","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-06-13"},"pocGithub":{"count":18,"skipped":5,"earliest":"2025-06-03","earliestUrl":"https://github.com/rxerium/CVE-2025-49113","repos":[{"name":"fearsoff-org/CVE-2025-49113","url":"https://github.com/fearsoff-org/CVE-2025-49113","stars":109,"created":"2025-06-04"},{"name":"hakaioffsec/CVE-2025-49113-exploit","url":"https://github.com/hakaioffsec/CVE-2025-49113-exploit","stars":94,"created":"2025-06-06"},{"name":"00xCanelo/CVE-2025-49113","url":"https://github.com/00xCanelo/CVE-2025-49113","stars":8,"created":"2025-07-19"},{"name":"BiiTts/Roundcube-CVE-2025-49113","url":"https://github.com/BiiTts/Roundcube-CVE-2025-49113","stars":6,"created":"2025-06-10"},{"name":"rxerium/CVE-2025-49113","url":"https://github.com/rxerium/CVE-2025-49113","stars":5,"created":"2025-06-03"}]},"metasploit":[{"name":"Roundcube Post-Auth RCE via PHP Object Deserialization","module":"exploit/multi/http/roundcube_auth_rce_cve_2025_49113","type":"exploit","disclosureDate":"2025-06-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb"}],"nuclei":[{"id":"CVE-2025-49113","name":"Roundcube Webmail - Remote Code Execution","severity":"critical","path":"http/cves/2025/CVE-2025-49113.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49113.yaml"}],"first":{"date":"2025-06-02","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb"},"provenance":"source"},"exploitRefs":["https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script","https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-06-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49113","provenance":"source"},{"date":"2025-06-02","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-06-03, Exploit-DB 2025-06-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb","provenance":"source"},{"date":"2025-06-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://fearsoff.org/research/roundcube","provenance":"source"},{"date":"2026-02-20","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-02-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16605","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":263},"priority":{"score":79.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 514 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 18 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}