Roundcube _from Deserialization RCE

Product: Roundcube Roundcube Webmail
CVE: CVE-2025-49113
Disclosed: 2025-06-01
CVSS: 9.9
Auth: requires auth / interaction
CISA KEV: yes
Affected: < 1.5.10, 1.6.0 - 1.6.10
Fixed: 1.5.10, 1.6.11

Summary

A decade-old bug in Roundcube's settings upload handler lets any logged-in user inject a crafted PHP serialized object into their session and execute code. Exploits circulated days after the patch, and credentials are often easy to obtain via phishing or reuse.

Root cause

program/actions/settings/upload.php did not validate the _from URL parameter, which ends up in the session. A '!'-prefixed key corrupts Roundcube's custom session serialization so that attacker data is unserialized, and a Crypt_GPG_Engine gadget chain executes commands.

Impact

Post-authentication RCE as the web server user on hundreds of thousands of webmail servers.

Public PoC

# post-auth: target URL, valid username and password, command
php CVE-2025-49113.php http://127.0.0.1:9876/ roundcube fearsoff.org "cat /etc/passwd > /tmp/pwned"

Source: FearsOff (Kirill Firsov) / CVE-2025-49113

Detection

Look for requests to '?_task=settings&_action=upload' with unusual _from values (containing '!' or serialized data). nuclei template CVE-2025-49113.

Mitigation

Upgrade to 1.5.10 / 1.6.11+.