Loading story…
Roundcube released security updates 1.6.11 and 1.5.10 to fix CVE-2025-49113, a critical post-authentication remote code execution flaw in its open-source webmail platform. The vulnerability affects versions earlier than 1.6.11 and the LTS branch earlier than 1.5.10, and stems from improper sanitization of the _from parameter in /program/actions/settings/upload.php, which can lead to PHP object deserialization and arbitrary code execution.
Researchers and national defenders reported that the flaw is being actively exploited and that public analysis of the June hotfix helped attackers develop working exploits. FearsOff published technical research and proof-of-concept details, while CSIRT.SK said exploit code is being sold on hacker forums and warned that attackers may obtain the required authenticated access through phishing, brute-force, or CSRF. Administrators were urged to upgrade immediately and review Roundcube, network, and security logs for signs of compromise.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that CVE-2025-49113 in Roundcube was being actively exploited and that a working exploit derived from analysis of the June 1 hotfix was being sold on hacker forums. The advisory urged administrators to upgrade immediately and review logs for signs of exploitation.
FearsOff published technical research on Roundcube CVE-2025-49113, describing post-authentication remote code execution via PHP object deserialization. CSIRT.SK states that FearsOff also published proof-of-concept exploit code demonstrating the issue.
Roundcube released versions 1.6.11 and 1.5.10 to address CVE-2025-49113, a critical post-authentication remote code execution flaw affecting earlier versions. The hotfix later enabled researchers and attackers to analyze the vulnerability in detail.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcefearsoff.org
Open sourceroundcube.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions **1.6.16** and **1.7.1**, following earlier fixes in **1.6.14** for the 1.6.x line. The newly disclosed issues include **CVE-2026-48842**, a pre-authentication SQL injection flaw in the `virtuser_query` plugin with a CVSS score of **8.1**, and **CVE-2026-48844**, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as **CVE-2026-48845** through **CVE-2026-48849**, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities. Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include **y0us**, **Georgios Tsimpidas**, **flydragon777**, the **Martila Security Research Team**, **aikido_security**, and **nullcathedral**. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.
Jun 29, 2026
Roundcube remediated **CVE-2025-49113**, a serious vulnerability that allows an authenticated attacker to execute arbitrary code remotely on affected Roundcube Webmail servers. Successful exploitation could enable exposure of sensitive data and compromise of the mail environment. The Dutch National Cyber Security Centre reported that public exploit code is circulating, raising the likelihood of abuse, and rated both likelihood and impact as High. Organizations running the 1.6.x branch should upgrade to **1.6.11**, while those using the 1.5.x LTS branch should upgrade to **1.5.10** as soon as possible.
Aug 31, 2026
Roundcube has released **Webmail 1.6.18** and **1.7.3** to fix **11 security vulnerabilities**, led by **`CVE-2026-74997`**, a high-severity remote code execution flaw in the **markasjunk** plugin’s **`cmd_learn`** driver. The bug, classified as **CWE-78**, affects **Roundcube 1.6.x before 1.6.18** and **1.7.x before 1.7.3** and can be triggered through crafted placeholder replacement values, potentially allowing command execution on the mail server with impacts to confidentiality, integrity, and availability. Roundcube urged all production deployments to upgrade, and administrators were advised to disable the **markasjunk** plugin if it is not needed. The security updates also address SSRF filter bypasses, remote content blocking bypass, LDAP filter injection, arbitrary Sieve script injection, IMAP command injection, stored XSS, HTML/CSS sanitization bypasses, and a **modoboa** password-driver issue that could leak an authentication token to a user-controlled host. Roundcube said the flaws could expose webmail environments to mail theft, persistence, and lateral movement if left unpatched, and recommended restricting outbound connectivity from Roundcube hosts in addition to applying the new releases.
Aug 18, 2026