KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-49113
9.9
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityRoundCube Webmail Deserialization of Untrusted Data Vulnerability
VendorRoundcube
ProductWebmail
Date added2026-02-20
Due date2026-03-13
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-502
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Descriptions
KEV: RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
NVD: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-06-11 19:01 UTC
Wall time45.0s
Searches4
Component defaultyes
Sources
https://nvd.nist.gov/vuln/detail/CVE-2025-49113
https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
https://github.com/advisories/GHSA-8j8w-wwqc-x596
https://www.offsec.com/blog/cve-2025-49113/
https://fearsoff.org/research/roundcube
https://github.com/fearsoff-org/CVE-2025-49113
https://www.exploit-db.com/exploits/52324
https://www.helpnetsecurity.com/2025/06/09/roundcube-rce-dark-web-activity-signals-imminent-attacks-cve-2025-49113/
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb
https://cloud.projectdiscovery.io/library/CVE-2025-49113
http://www.openwall.com/lists/oss-security/2025/06/02/3
https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
https://github.com/advisories/GHSA-8j8w-wwqc-x596
https://www.offsec.com/blog/cve-2025-49113/
https://fearsoff.org/research/roundcube
https://github.com/fearsoff-org/CVE-2025-49113
https://www.exploit-db.com/exploits/52324
https://www.helpnetsecurity.com/2025/06/09/roundcube-rce-dark-web-activity-signals-imminent-attacks-cve-2025-49113/
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb
https://cloud.projectdiscovery.io/library/CVE-2025-49113
http://www.openwall.com/lists/oss-security/2025/06/02/3
Hunting hypothesis agent
Monitor for HTTP POST requests to Roundcube Webmail upload.php with crafted serialized PHP objects in the _from parameter leading to remote code execution.
Research details
Componentprogram/actions/settings/upload.php (session injection via _from GET parameter, PHP Object Deserialization via Crypt_GPG_Engine gadget chain)
PreconditionsThe vulnerability requires an authenticated Roundcube Webmail user with a valid session. The attacker must be able to access the /settings/upload.php endpoint, which is part of the default Roundcube installation and available to all authenticated users. The exploit chains two injection points: (1) the _from GET parameter in program/actions/settings/upload.php, which is insufficiently sanitized (only dot-to-dash replacement) and passed directly into the session append() method, and (2) the filename parameter in the multipart file upload body, which carries padding to align the deserialization structure. The attack leverages a custom unserialize() handler bug in Roundcube's session management where the "!" character causes the parser to skip value parsing, enabling injection of arbitrary serialized PHP objects into the session state. The Crypt_GPG_Engine class from the PEAR Crypt_GPG package serves as the gadget chain — its _closeIdleAgents() method passes the user-controlled _gpgconf property to proc_open(), resulting in arbitrary command execution. The PHP proc_open() function must be enabled on the target server for the gadget chain to work (it is enabled by default on most installations). The vulnerability has persisted in the Roundcube codebase for over 10 years (since at least 2014) and affects all versions before 1.5.10 and 1.6.x before 1.6.11. In a typical enterprise deployment, Roundcube serves as the primary webmail interface connected to IMAP/SMTP servers, often hosted on shared or dedicated Linux servers running Apache/Nginx with PHP and MySQL/PostgreSQL. The settings upload functionality is intended for importing configurations, contact photos, and identity images. Exploitation results in server-level RCE as the web server user, enabling lateral movement to mail stores, databases, and internal networks. agent
DeliveryThe attacker sends a crafted HTTP POST request to the /settings/upload.php endpoint with a multipart file upload. The _from GET parameter contains a malformed session serialization string that exploits the Roundcube custom unserialize() handler's "!" character bug to inject a serialized Crypt_GPG_Engine gadget object. The filename parameter in the multipart body provides session key/value padding to align the deserialization. When the session is written and subsequently reloaded (e.g., during logout or another request), the deserialized Crypt_GPG_Engine object's _closeIdleAgents() method is invoked, passing its _gpgconf property (attacker-controlled command string) to proc_open(), executing arbitrary system commands on the web server.
Public PoCyes
PoC URLs
https://github.com/fearsoff-org/CVE-2025-49113
https://github.com/hakaioffsec/CVE-2025-49113-exploit
https://github.com/Zwique/CVE-2025-49113
https://github.com/Evillm/CVE-2025-49113-PoC
https://www.exploit-db.com/exploits/52324
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb Third-party repos; verify before use.
https://github.com/hakaioffsec/CVE-2025-49113-exploit
https://github.com/Zwique/CVE-2025-49113
https://github.com/Evillm/CVE-2025-49113-PoC
https://www.exploit-db.com/exploits/52324
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)
SummaryCVE-2025-49113 is a critical post-authentication remote code execution vulnerability in Roundcube Webmail (versions < 1.5.10 and 1.6.0-1.6.10) caused by insufficient validation of the _from parameter in program/actions/settings/upload.php, leading to PHP Object Deserialization via Crypt_GPG_Engine gadget chain. Multiple public PoC exploits exist including the original by Kirill Firsov, several GitHub repositories, and a Metasploit module. CISA added this to KEV on 2026-02-20 due to active exploitation.
Tia coverage
First reported2026-08-11
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.