Cybersecurity researchers have disclosed details of a critical security flaw in the Roundcube webmail software that has gone unnoticed for a decade and could be exploited to take over susceptible systems and execute arbitrary code.
The vulnerability, tracked as CVE-2025-49113, carries a CVSS score of 9.9 out of 10.0. It has been described as a case of post-authenticated remote code execution via PHP object deserialization.
“Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization,” reads the description of the flaw in the NIST’s National Vulnerability Database (NVD).
The shortcoming, which affects all versions of the software before and including 1.6.10, has been addressed in 1.6.11 and 1.5.10 LTS. Kirill Firsov, founder and CEO of FearsOff, has been credited with discovering and reporting the flaw.
The Dubai-based cybersecurity company noted in a brief advisory that it intends to make public additional technical details and a proof-of-concept (PoC) “soon” so as to give users sufficient time to apply the necessary patches.
Previously disclosed security vulnerabilities in Roundcube have been a lucrative target for nation-state threat actors like APT28 and Winter Vivern. Last year, Positive Technologies revealed that unidentified hackers attempted to exploit a Roundcube flaw (CVE-2024-37383) as part of a phishing attack designed to steal user credentials.
Then a couple of weeks ago, ESET noted that APT28 had leveraged cross-site scripting (XSS) vulnerabilities in various webmail servers such as Roundcube, Horde, MDaemon, and Zimbra to harvest confidential data from specific email accounts belonging to governmental entities and defense companies in Eastern Europe.
Update
Positive Technologies, in a post published on X, said it was able to reproduce CVE-2025-49113, urging users to update to the latest version of Roundcube as soon as possible.
“This vulnerability allows authenticated users to execute arbitrary commands via PHP object deserialization,” the Russian cybersecurity company added.
Update
CVE-2025-49113 Likely Comes Under Exploitation
FearsOff has released technical details of CVE-2025-49113 and a proof-of-concept (PoC) after reports of “active exploitation and evidence of the exploit being sold in underground forums.” Describing it as an “email armageddon,” the company said the vulnerability affects over 53 Million hosts.
The problem, according to Firsov, is rooted in the fact that starting a session variable name with an exclamation mark causes a session to get corrupted and the “$_GET[‘_from’]” parameter used during image uploads for managing sender identities in Roundcube lacks as any sanitization, allowing an attacker to inject a malicious payload into the current session.
“This vulnerability is now known, exploitable, and being sold,” Firsov said. “Consider monitoring file uploads, session activity, and other indicators tied to this attack vector.”
