⚠ Actively exploited
Added to CISA KEV on 2026-02-20. Federal agencies required to patch by 2026-03-13. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-49113 — Deserialization of Untrusted Data in Webmail
Severity
8.8HIGHNVD
CNA9.9VulnCheck9.9
EPSS
91.2%
top 0.35%
CISA KEV
KEV
Added 2026-02-20
Due 2026-03-13
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJun 2
KEV addedFeb 20
KEV dueMar 13
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages3 packages
Also affects: Debian Linux 11.0
Patches
🔴Vulnerability Details
5💥Exploits & PoCs
2Nuclei▶
Roundcube Webmail - Remote Code Execution
🔍Detection Rules
1Suricata▶
ET WEB_SPECIFIC_APPS Roundcube Post-Auth RCE via PHP Object Deserialization (CVE-2025-49113)↗2025-07-14
📋Vendor Advisories
4Red Hat
▶
Debian▶
CVE-2025-49113: roundcube - Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execu...↗2025
🕵️Threat Intelligence
13Bleepingcomputer
▶