CVE-2025-49113

CVE Database · CVE-2025-49113

CVE-2025-49113

· CRITICALAnalyzed

CVSS v3.1

9.9

EPSS

89.16%

Published

Jun 2, 2025

Modified

Feb 23, 2026

CISA Known Exploited Vulnerability

Added: 2026-02-20 · Due: 2026-03-13

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public PoC / Exploit (11)

All weaponized →

Exploit-DBRoundcube 1.6.10 - Remote Code Execution (RCE)NucleiNuclei detection template TrickestTrickest PoC index GitHub PoCfearsoff-org/CVE-2025-49113★103 GitHub PoChakaioffsec/CVE-2025-49113-exploit★90 GitHub PoC00xCanelo/CVE-2025-49113★7 GitHub PoCBiiTts/Roundcube-CVE-2025-49113★6 GitHub PoCrxerium/CVE-2025-49113★5 GitHub PoCZwique/CVE-2025-49113★4 GitHub PoCAdemking/CVE-2025-49113-nuclei-template★3 GitHub PoCrasool13x/exploit-CVE-2025-49113★3

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502CWE-502

Affected Products (3)

roundcube · webmail (up to 1.5.10)vulnerable

roundcube · webmail (up to 1.6.11)vulnerable

debian · debian_linuxvulnerable

References (13)

https://fearsoff.org/research/roundcube

Third Party Advisory

https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d