CVE-2025-49113

Vendordebian, roundcubeProductdebian linux, webmailDiscoveredJun 2, 2025UpdatedFeb 23, 2026

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

View graph Watch Export

CVSS v3.1

9.9 CRITICAL

EPSS

99.5%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 30, 2026

▲ 1.80pp

97.7% → 99.5% over 7 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Connections

8 relationships

Timeline

disclosure → media coverage

Jun 2, 2025

Disclosure — published as a CVE record. · last revised by NVD Feb 23, 2026

Feb 21, 2026

thehackernews.com reports: CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog

Sep 24, 2026

bleepingcomputer.com reports: Hackers now exploit critical Roundcube flaw in code injection attacks

Sep 25, 2026

securityweek.com reports: Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Sep 25, 2026

thehackernews.com reports: Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Public PoC (10)

github.com/rxerium/CVE-2025-49113 github.com/Ademking/CVE-2025-49113-nuclei-template github.com/fearsoff-org/CVE-2025-49113 github.com/rasool13x/exploit-CVE-2025-49113 github.com/SyFi/CVE-2025-49113 github.com/hakaioffsec/CVE-2025-49113-exploit github.com/BiiTts/Roundcube-CVE-2025-49113 github.com/5kr1pt/Roundcube_CVE-2025-49113 github.com/hackmelocal/CVE-2025-49113-Simulation github.com/Joelp03/CVE-2025-49113

Unverified third-party code — review before executing.