EUVD-2025-16605
GHSA-8j8w-wwqc-x596
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.9 (Critical). EPSS 90.4% — near-certain exploitation. KEV-listed — actively exploited. Public PoC available. Patch available. Only requires basic email authentication. Roundcube is massively deployed worldwide. Mail server compromise = access to all mailboxes. |
| Exploit ScenarioDerived | An attacker with a valid email account on a Roundcube instance (which could be a free account from a hosting provider) sends a crafted request to the upload endpoint with a malicious _from parameter. Roundcube deserializes the attacker's payload, executing arbitrary PHP code on the server. The attacker gains: access to all email accounts on the server, ability to read/send email as any user, access to the server's filesystem and database, and potentially pivot access to other services on the same infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows authenticated users to achieve remote code execution through a crafted upload URL. With EPSS 90.4% and KEV listing, this vulnerability in one of the most widely deployed open-source webmail platforms enables any email user to compromise the mail server, accessing all hosted mailboxes.
Earlier versions of this analysis (1)
Roundcube Webmail fails to validate the _from parameter in upload URLs (CWE-502), allowing authenticated users to trigger PHP object deserialization that leads to remote code execution on the mail server.
RemediationAI
Upgrade Roundcube to 1.5.10+ or 1.6.11+ immediately. This is emergency priority given the 90% EPSS. If unable to patch, restrict access to the upload endpoint. Audit mail server for signs of compromise. Review recently sent emails for unauthorized access indicators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in program/actions/settings/upload.php where the _from parameter from the URL is not validated before use. An authenticated user can inject a crafted value that triggers PHP's unserialize() on attacker-controlled data. Using POP (Property Oriented Programming) gadget chains available in Roundcube's codebase or dependencies, the attacker achieves arbitrary PHP code execution. Roundcube is one of the most deployed webmail solutions, used by hosting providers, enterprises, and government organizations.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Executive ViewAI
Roundcube Webmail installations are vulnerable to remote code execution attacks by authenticated users, with active exploitation confirmed in the wild. Organizations running affected versions face immediate risk of unauthorized system access, data theft, and potential lateral movement within their infrastructure.
Apply vendor patch. If patching is delayed: implement Web Application Firewall rules to block requests containing serialized PHP objects in the _from parameter; restrict Roundcube access by IP address; disable file upload functionality in settings if not business-critical; monitor authentication logs for anomalous admin activity.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
An issue was discovered in Roundcube Webmail before 1.4.4. Rated medium severity (CVSS 6.5), this vulnerability is remot
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Authentication Bypass
View allVendor StatusVendor
Ubuntu
Priority: High| Release | Status | Version |
|---|---|---|
| upstream | released | 1.6.11+dfsg-1 |
| bionic | released | 1.3.6+dfsg.1-1ubuntu0.1~esm5 |
| focal | released | 1.4.3+dfsg.1-1ubuntu0.1~esm5 |
| jammy | released | 1.5.0+dfsg.1-2ubuntu0.1~esm4 |
| noble | released | 1.6.6+dfsg-2ubuntu0.1 |
| oracular | released | 1.6.8+dfsg-2ubuntu0.1 |
| plucky | released | 1.6.10+dfsg-1ubuntu0.1 |
| xenial | released | 1.2~beta+dfsg.1-0ubuntu1+esm6 |
| questing | not-affected | 1.6.11+dfsg-1 |
Debian
Bug #1107073| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 1.4.15+dfsg.1-1+deb11u5 | - |
| bullseye (security) | fixed | 1.4.15+dfsg.1-1+deb11u7 | - |
| bookworm | fixed | 1.6.5+dfsg-1+deb12u5 | - |
| bookworm (security) | fixed | 1.6.5+dfsg-1+deb12u7 | - |
| trixie (security), trixie | fixed | 1.6.13+dfsg-0+deb13u1 | - |
| forky, sid | fixed | 1.6.13+dfsg-1 | - |
| (unstable) | fixed | 1.6.11+dfsg-1 | - |