CVE-2025-49113: Roundcube Webmail PHP Object Deserialization RCE via _from Parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityActive exploitation in CISA KEV, near-maximum EPSS score, and remote code execution with low complexity make this an urgent patching priority.

What it is

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 fails to validate the _from parameter in program/actions/settings/upload.php, allowing PHP object deserialization. An authenticated user can exploit this to execute arbitrary code on the server. The flaw is remotely reachable and has been added to CISA KEV, indicating active exploitation.

Impact

An attacker with a valid webmail account gains remote code execution on the Roundcube server, leading to full compromise of the webmail host and potentially the underlying mail infrastructure.

Attack surface

The vulnerability is reached over the network via a crafted URL to the upload.php endpoint. Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

CISA KEV lists this as actively exploited (added 2026-02-20), and EPSS probability is 0.98897 (99.9th percentile). Public exploit and mitigation references exist, confirming real-world exploitation.

What to do

• Upgrade Roundcube Webmail to version 1.5.10 or 1.6.11 or later immediately.
• Apply vendor patches from the referenced commits if immediate upgrade is not possible.
• Restrict access to the upload.php endpoint or disable the affected settings upload functionality if feasible.
• Follow CISA BOD 22-01 guidance for cloud services and apply mitigations per vendor instructions.
• Monitor for and remove any unauthorized accounts or web shells on Roundcube servers.

Detection

• Inspect web server logs for requests to program/actions/settings/upload.php with suspicious _from parameters containing serialized PHP objects.
• Monitor for unexpected PHP processes or outbound connections from the Roundcube server.
• Use the Vicarius detection script referenced in the advisory to scan for indicators of compromise.
• Audit Roundcube user accounts for unauthorized creation or privilege changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.