Roundcube · Webmail
The Roundcube Webmail product contains a deserialization of untrusted data flaw in the _from parameter of program/actions/settings/upload.php, which is not validated before the data is processed, affecting versions before 1.5.10 and 1.6.x before 1.6.11. An attacker who is an authenticated user can remotely exploit this without user interaction to achieve remote code execution via PHP object deserialization, requiring only network access and valid low-privilege credentials.
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
First seen exploited 2 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
remote exploit of public-facing webmail application
allows remote code execution by authenticated users
deserialization yields code execution
leading to PHP Object Deserialization
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: roundcube/roundcubemail.
Upgrade to 1.6.11 or later
Set the version to 1.6.11 or later in your composer.json.
The first fix for CVE-2025-49113. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 1.6.0 up to 1.6.11 | 1.6.11 |
| All versions before 1.5.10 | 1.5.10 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.