CVE-2025-49113

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Overview

State: PUBLISHED
Assigner (CNA): mitre
CVSS severity: CRITICAL
CVSS score: 9.9 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Effective score: 9.9 / 10 CRITICAL source: CNA overview
CWE(s): CWE-502
Reserved: 2025-06-02
Published: 2025-06-02 00:00 UTC
Last updated: 2026-02-21 04:56 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json
Linked Threat: CVE-2025-49113 — Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Vendor / project: Roundcube
Product: Webmail
Date added to KEV: 2026-02-20
Remediation due: 2026-03-13
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49113
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-06-02 05:15:53 UTC
NVD last modified: 2026-02-23 13:24:21 UTC
NVD CVSS v3.1: 9.9 / 10 CRITICAL source: cve@mitre.org
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability subscore: 3.1 / 10
Impact subscore: 6.0 / 10
EPSS score: 0.9041 (probability of exploitation in next 30 days)
EPSS percentile: 99.62% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-16605
Assigner: mitre
Published: Jun 2, 2025, 12:00:00 AM
Updated: Feb 21, 2026, 4:56:23 AM
EUVD base score (CVSS 3.1): 9.9 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EUVD-reported EPSS: 90.4700
Vendors: Roundcube
Products: Webmail (0 <1.5.10)

Webmail (1.6.0 <1.6.11)
Aliases: GHSA-8j8w-wwqc-x596

ENISA description: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

EUVD references (10)

Affected products (1)

Vendor	Product	Versions	Platforms
Roundcube	Webmail	`0` (affected), `1.6.0` (affected)	—

Affected products — CPE 2.3 (2) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Vendor references (10)

References embedded in the original CVE record by the assigning CNA.

MITRE references (10) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (4)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://attackerkb.com/topics/CVE-2025-49113 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16605 rapid7:euvd.enisa.europa.eu
https://www.cve.org/CVERecord?id=CVE-2025-49113 rapid7:www.cve.org
http://cwe.mitre.org/data/definitions/502.html rapid7:cwe.mitre.org

NVD-tagged references (13)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

http://www.openwall.com/lists/oss-security/2025/06/02/3 af854a3a-2127-422b-91ae-364da2661108 Mailing ListThird Party Advisory
https://fearsoff.org/research/roundcube cve@mitre.org Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d cve@mitre.org Patch
https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695 cve@mitre.org Patch
https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e cve@mitre.org Patch
https://github.com/roundcube/roundcubemail/pull/9865 cve@mitre.org Issue Tracking
https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 cve@mitre.org Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 cve@mitre.org Release Notes
https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html af854a3a-2127-422b-91ae-364da2661108 Mailing ListThird Party Advisory
https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 cve@mitre.org Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script cve@mitre.org ExploitMitigationThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection cve@mitre.org ExploitMitigationThird Party Advisory

Indicators (3)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cwe	`CWE-502`	no local data	2026-05-14 02:58 UTC
cve	`CVE-2025-49113`	no local data	2026-05-14 02:58 UTC
domain	`upload.php`	no local data	2026-05-16 05:44 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-14 15:20 UTC
Microsoft Patch Tuesday, September 2025 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited vulnerabilities ...

2026-05-14 15:20 UTC
Nvd - Cve-2025-48913

web:nvd.nist.gov

Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

2026-05-14 15:20 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-14 15:20 UTC
Microsoft releases emergency updates to fix Windows Server issues

web:www.bleepingcomputer.com

Microsoft has released out-of-band (OOB) updates to fix issues affecting Windows Server systems after installing the April 2026 security updates.

2026-05-14 15:20 UTC
Update Software, Mitigation M1051 - Enterprise | MITRE ATT&CK®

web:attack.mitre.org

This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...

2026-05-14 15:20 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-14 15:20 UTC
Latest Windows Update Problems and How to Fix Them

web:www.maketecheasier.com

Check out the latest Windows 11 and Windows 10 update problems and their solutions, as recommended by Microsoft experts.

2026-05-14 15:20 UTC
CISA Required Action

CISA KEV

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-03-13 Known ransomware campaign use: Unknown

2026-05-14 01:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-49113.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-49113",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-02-20",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-21T04:56:23.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-20T00:00:00.000Z",
            "value": "CVE-2025-49113 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-06-09T03:27:58.478Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/02/3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Webmail",
          "vendor": "Roundcube",
          "versions": [
            {
              "lessThan": "1.5.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.6.11",
              "status": "affected",
              "version": "1.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.6.11",
                  "versionStartIncluding": "1.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T16:09:32.854Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10"
        },
        {
          "url": "https://github.com/roundcube/roundcubemail/pull/9865"
        },
        {
          "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11"
        },
        {
          "url": "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d"
        },
        {
          "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10"
        },
        {
          "url": "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695"
        },
        {
          "url": "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e"
        },
        {
          "url": "https://fearsoff.org/research/roundcube"
        },
        {
          "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection"
        },
        {
          "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-49113",
    "datePublished": "2025-06-02T00:00:00.000Z",
    "dateReserved": "2025-06-02T00:00:00.000Z",
    "dateUpdated": "2026-02-21T04:56:23.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}