CVE-2025-49113: Roundcube Webmail post-auth RCE via PHP object deserialization

Exploited in the wild High 8.8 EPSS 99.5% Roundcube Webmail

Roundcube Webmail does not validate the _from URL parameter in program/actions/settings/upload.php, which leads to PHP object deserialization and lets any logged-in user run code on the server. Every webmail user (or anyone with stolen mail credentials) can therefore take over the web server account. Fixed in 1.6.11 and 1.5.10 on 1 June 2025; CISA added it to KEV on 20 February 2026.

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

  1. Check whether you run Roundcube Webmail and which version (commands below).
  2. Install the fixed version for your system: see “Patch it” below.
  3. Reload PHP-FPM or Apache if you use OPcache.
  4. If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
  5. Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

Fixed in:

Am I affected?

dpkg -l 'roundcube*' | grep ^ii   # Debian/Ubuntu
grep RCMAIL_VERSION /path/to/roundcube/program/include/iniset.php   # tarball installs

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian
sudo apt update
sudo apt install --only-upgrade roundcube roundcube-core
Ubuntu
sudo apt update
sudo apt install --only-upgrade roundcube roundcube-core
RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh roundcubemail (EPEL)
Fedora
sudo dnf upgrade --refresh roundcubemail
SUSE / openSUSE
sudo zypper refresh
sudo zypper update roundcubemail
Amazon Linux
not in distro repos: vendor repository
Arch Linux
sudo pacman -Syu
Alpine
not packaged: upstream tarball
FreeBSD
pkg update && pkg upgrade roundcube-php84 (roundcube-phpXY)
Built from source
# download 1.6.11+ (or 1.5.10+) from https://roundcube.net/download/ and run:
./bin/installto.sh /path/to/roundcube

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

ReleasePackageStatusFixed version / advisory
Debian 12roundcubefixed1.6.5+dfsg-1+deb12u5
Debian 13roundcubefixed1.6.11+dfsg-1
Debian testingroundcubefixed1.6.11+dfsg-1
Ubuntu 26.10roundcubenot affected
Ubuntu 18.04 (ESM)roundcubefixed1.3.6+dfsg.1-1ubuntu0.1~esm5
Ubuntu 20.04 (ESM)roundcubefixed1.4.3+dfsg.1-1ubuntu0.1~esm5
Ubuntu 22.04roundcubefixed1.5.0+dfsg.1-2ubuntu0.1~esm4
Ubuntu 24.04roundcubefixed1.6.6+dfsg-2ubuntu0.1
Ubuntu 25.10roundcubenot affected
Ubuntu 26.04roundcubenot affected
Debian 13 (trixie)roundcubefixed1.6.11+dfsg-1
Debian 12 (bookworm)roundcubefixed1.6.5+dfsg-1+deb12u5 (DSA-5934-1)
Debian 11 (bullseye)roundcubefixed1.4.15+dfsg.1-1+deb11u5 (DLA-4211-1)
Ubuntu 24.04 LTSroundcubefixed1.6.6+dfsg-2ubuntu0.1 (USN-7584-1)
Ubuntu 22.04 LTS (ESM)roundcubefixed1.5.0+dfsg.1-2ubuntu0.1~esm4 (USN-7584-1)
Ubuntu 20.04 LTS (ESM)roundcubefixed1.4.3+dfsg.1-1ubuntu0.1~esm5 (USN-7584-1)

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49113

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.