CVE-2025-49113

🗓️ 02 Jun 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 63 Media mentions👁 537 Views🌐 WEB

Remote code execution vulnerability in Roundcube Webmail affects versions before 1.5.10 and 1.6.11.

Reporter	Title	Published	Views	Family All 90
GithubExploit	Exploit for CVE-2025-49113	19 Aug 202502:35	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	18 Jun 202519:10	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	19 Sep 202506:07	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	11 Jul 202513:19	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	10 Jun 202515:21	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Roundcube Webmail	11 Apr 202621:54	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	3 Jun 202519:04	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	19 Sep 202506:07	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	22 Jun 202516:13	–	githubexploit
GithubExploit	Exploit for CVE-2025-49113	11 Jul 202513:19	–	githubexploit

NVD

Vulners

CNA

Node

roundcube webmailRange<1.5.10

roundcube webmailRange1.6.0–1.6.11

Node

debian debian_linuxMatch11.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Webmail",
    "vendor": "Roundcube",
    "versions": [
      {
        "lessThan": "1.5.10",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.6.11",
        "status": "affected",
        "version": "1.6.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e
github	www.github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
fearsoff	www.fearsoff.org/research/roundcube
github	www.github.com/roundcube/roundcubemail/releases/tag/1.5.10
github	www.github.com/roundcube/roundcubemail/pull/9865
github	www.github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695
vicarius	www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script
roundcube	www.roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
github	www.github.com/roundcube/roundcubemail/releases/tag/1.6.11
vicarius	www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection

Parameter	Position	Path	Description	CWE
_from	query param	program/actions/settings/upload.php	Authenticated deserialization via unchecked _from parameter in settings/upload.php leading to RCE	CWE-502
filename	upload data	/?_task=settings&_action=upload	Deserialization payload delivered via crafted filename in multipart upload to settings/upload endpoint	CWE-502
_file	upload data	/?_task=settings&_action=upload	Deserialization payload delivered via crafted filename in multipart upload to settings/upload endpoint	CWE-502

23 Feb 2026 13:24Current

8High risk

Vulners AI Score8

CVSS 3.18.8 - 9.9

EPSS0.90469

SSVC