CVE-2025-49113: Roundcube Webmail Post-Auth Deserialization RCE (KEV)
CVE-2025-49113 is a PHP Object Deserialization flaw in Roundcube Webmail's file-upload settings page that lets any already-authenticated user (even a low-privilege mailbox user) send one crafted URL to achieve remote code execution on the mail server, and it has been under mass exploitation since shortly after disclosure.
Vulnerability summary
| Vulnerability ID | CVE-2025-49113 |
|---|---|
| CVSS score | 8.8 |
| EPSS score | 0.9949 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2025-06-02T05:15:53.420 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Roundcube Webmail | cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* | Before 1.5.10; 1.6.0 through 1.6.10 (fixed in 1.5.10 and 1.6.11) |
What this means
CVE-2025-49113 (CWE-502, deserialization of untrusted data) is in program/actions/settings/upload.php of Roundcube Webmail. NVD's description states: "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated ... leading to PHP Object Deserialization" (NVD).
NVD's own analysis assigns a CVSS v3.1 Primary score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, requiring only low (authenticated-user) privileges and no user interaction, with high impact to confidentiality, integrity and availability. The CVE's CNA (MITRE) separately submitted a higher Secondary score of 9.9 with a Changed scope (S:C), reflecting that compromising the mail server can affect components beyond Roundcube itself; this page uses NVD's own Primary 8.8 figure as the confirmed score (NVD).
Roundcube's own security announcement describes it as a "Post-Auth RCE via PHP Object Deserialization," credits researcher Kirill Firsov for the report, and ships the fix in versions 1.6.11 and 1.5.10, with three patch commits in the Roundcube GitHub repository addressing the unvalidated _from parameter (Roundcube, Security updates 1.6.11 and 1.5.10; roundcube/roundcubemail commit 0376f69).
CISA added CVE-2025-49113 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-02-20, roughly eight months after the June 2025 disclosure, with a required-action due date of 2026-03-13 — consistent with a vulnerability that saw exploitation activity accelerate well after patches were already available (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.9949 (99.945th percentile) — among the highest EPSS scores observed, reflecting the fact that an authenticated-only requirement is a low bar on Roundcube instances that allow self-registration or where any valid mailbox credential (including a free trial or low-value account) can reach the vulnerable endpoint (FIRST EPSS).
Any Roundcube Webmail deployment on 1.5.x before 1.5.10 or 1.6.x before 1.6.11 should be patched immediately and checked for signs of prior compromise given the documented mass exploitation and near-maximal EPSS score.
Evidence
- Unvalidated _from parameter in program/actions/settings/upload.php allows an authenticated user to trigger PHP Object Deserialization, leading to remote code execution. Affects Roundcube before 1.5.10 and 1.6.x before 1.6.11. — NVD
- NVD Primary CVSS v3.1 score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; a Secondary CNA score of 9.9 with Changed scope was also submitted but is not NVD's own figure. — NVD
- Described as a Post-Auth RCE via PHP Object Deserialization; researcher credited as Kirill Firsov; fixed in versions 1.6.11 and 1.5.10. — Roundcube, Security updates 1.6.11 and 1.5.10
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-02-20, required-action due date 2026-03-13. — CISA KEV
- EPSS score is 0.9949 (99.945th percentile) as of 2026-10-29. — FIRST EPSS