Roundcube Patches Actively Exploited CVE-2025-49113 Post-Auth RCE
Active Exploitation · 3 sources · Updated 4mo ago · First seen Jun 13, 2025
Roundcube released security updates 1.6.11 and 1.5.10 to fix CVE-2025-49113, a critical post-authentication remote code execution flaw in its open-source webmail platform. The vulnerability affects versions earlier than 1.6.11 and the LTS branch earlier than 1.5.10, and stems from improper sanitization of the _from parameter in /program/actions/settings/upload.php, which can lead to PHP object deserialization and arbitrary code execution.
Researchers and national defenders reported that the flaw is being actively exploited and that public analysis of the June hotfix helped attackers develop working exploits. FearsOff published technical research and proof-of-concept details, while CSIRT.SK said exploit code is being sold on hacker forums and warned that attackers may obtain the required authenticated access through phishing, brute-force, or CSRF. Administrators were urged to upgrade immediately and review Roundcube, network, and security logs for signs of compromise.
