CVE-2025-49113 in Roundcube
Summary
by MITRE • 06/02/2025
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/20/2026
The vulnerability identified as CVE-2025-49113 represents a critical remote code execution flaw affecting Roundcube Webmail versions prior to 1.5.10 and 1.6.x before 1.6.11. This security issue stems from inadequate input validation within the upload.php script located in the program/actions/settings directory of the webmail application. The vulnerability specifically targets the _from parameter in URLs, which when improperly handled during PHP object deserialization processes, creates an exploitable condition that allows authenticated attackers to execute arbitrary code on the affected system.
The technical implementation of this vulnerability falls under CWE-502, which classifies it as a deserialization of untrusted data vulnerability. Attackers can leverage this flaw by crafting malicious payloads that exploit the insecure object deserialization mechanism in PHP, particularly when the _from parameter is passed through URL parameters to the upload.php script. This creates a pathway for authenticated users to manipulate the deserialization process, potentially leading to arbitrary code execution with the privileges of the web application. The vulnerability demonstrates a classic example of how improper input validation can lead to severe remote code execution scenarios.
The operational impact of this vulnerability extends beyond simple privilege escalation as it provides attackers with full control over the affected webmail server. Once exploited, attackers can execute commands on the server, potentially leading to data exfiltration, persistence mechanisms, or further network reconnaissance. The authenticated nature of the attack means that an attacker must first obtain valid credentials, but this is often achievable through various social engineering or credential compromise techniques. The vulnerability affects organizations that rely on Roundcube Webmail for email services, potentially exposing sensitive communications and user data to unauthorized access.
Mitigation strategies for CVE-2025-49113 should prioritize immediate patching of affected Roundcube installations to versions 1.5.10 or 1.6.11 and later. Organizations should also implement network segmentation to limit access to the webmail application and enforce strict access controls. Additional defensive measures include monitoring for suspicious URL parameters and implementing web application firewalls that can detect and block malicious deserialization attempts. The ATT&CK framework categorizes this vulnerability under T1566 for credential harvesting and T1059 for command and scripting interpreter, highlighting the need for comprehensive monitoring of both authentication and execution activities. Regular security assessments and input validation reviews should be conducted to prevent similar vulnerabilities in custom web applications that may utilize similar deserialization patterns.