9.9

CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability

CVSS: 9.9v3.1CriticalKEVAnalyzed
AliasesMGASA-2025-0185UBUNTU-CVE-2025-49113USN-7584-1
Published 02-06-2025Last modified 21-02-2026
Open JSON

Vulnerability summary

CVE-2025-49113 is a critical (CVSS 9.9) Deserialization of Untrusted Data vulnerability in Roundcube Webmail. It is known to be exploited: CISA lists it, first on 20-02-2026. EPSS estimates a 98.97% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)
EPSS score
98.97%
0%100%
Critical · +0.08 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits4reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 0 · Duplicates 1
CVE-2025-48745

Timeline

  1. 02-06-2025
    PublishedVulnerability first disclosed.
  2. 20-02-2026
    Added to CISA KEVRoundCube Webmail Deserialization of Untrusted Data Vulnerability
  3. 21-02-2026
    Last modifiedVulnerability information updated.
  4. 13-03-2026
    CISA remediation dueApply mitigations per vendor instructions.

Description

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

98.97%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.08 pp

From 98.90% on 20-09-2026

20-09-202620-10-2026
EPSS score
98.97%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
20-02-2026
Federal due date
13-03-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 github.com/roundcube/roundcubemail/releases/tag/1.5.10 github.com/roundcube/roundcubemail/releases/tag/1.6.11 nvd.nist.gov/vuln/detail/CVE-2025-49113

Public exploits

4 found
  • referenceUnverified

    Exploit Reference (vicarius.io)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (vicarius.io)

    Maturity: unknown

  • exploit-databasemultipleUnverified

    Roundcube 1.6.10 - Remote Code Execution (RCE)

    Maturity: poc

Show all 4 exploits
  • MetasploitMetasploitremoteVerified

    Roundcube Post-Auth RCE via PHP Object Deserialization

    exploit/multi/http/roundcube_auth_rce_cve_2025_49113

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • roundcube< 1.6.11+dfsg-1 | < 1.6.5+dfsg-1+deb12u5 | < 1.4.15+dfsg.1-1+deb11u5
  • debian_linuxEOL11.0
Mageia1 product
  • roundcubemail< 1.6.11-2.mga9
Roundcube1 product
  • webmail< 1.5.10 | ≥ 1.6.0, < 1.6.11
Ubuntu1 product
  • roundcube< 1.2~beta+dfsg.1-0ubuntu1+esm6 | < 1.3.6+dfsg.1-1ubuntu0.1~esm5 | < 1.4.3+dfsg.1-1ubuntu0.1~esm5 | < 1.5.0+dfsg.1-2ubuntu0.1~esm4 | < 1.6.6+dfsg-2ubuntu0.1

4 vendors · 5 products

References

23 links
Show all 23 references