CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-49113 is a critical remote code execution vulnerability in Roundcube Webmail caused by unsafe deserialization of crafted email content. Affecting Roundcube versions before 1.5.8 and 1.6.x before 1.6.9, this vulnerability allows an authenticated user who opens a specially crafted email message to trigger server-side code execution. With a CVSS v3.1 base score of 9.9 and a Changed scope, the impact extends beyond the vulnerable Roundcube instance to potentially compromise the underlying server infrastructure. The EPSS score of 32.12% at the 96th percentile signals extremely high exploitation probability, and CISA has confirmed active exploitation by including CVE-2025-49113 in its Known Exploited Vulnerabilities catalog with a remediation deadline of March 13, 2026. Roundcube Webmail is one of the most widely deployed open-source webmail clients, making this vulnerability a significant threat to organizations and hosting providers worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.5.10; >= 1.6.0, < 1.6.11 |
| debian | debian linux | 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://fearsoff.org/research/roundcube(Third Party Advisory)
- https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d(Patch)
- https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695(Patch)
- https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e(Patch)
- https://github.com/roundcube/roundcubemail/pull/9865(Issue Tracking)
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.10(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.11(Release Notes)
- https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script(Exploit, Mitigation, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection(Exploit, Mitigation, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2025/06/02/3(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-49113 falls under CWE-502 (Deserialization of Untrusted Data). This weakness occurs when an application deserializes data from an untrusted source without sufficient verification that the resulting data is valid and safe. Deserialization vulnerabilities are particularly dangerous because they can enable attackers to inject arbitrary objects into the application, which during the deserialization process can trigger code execution through specially crafted object chains known as gadget chains. In the context of Roundcube, email content — which is inherently untrusted as it originates from external senders — passes through a processing pipeline that includes a deserialization step. By embedding a crafted serialized payload within an email message, an attacker can cause the server to instantiate malicious objects that execute arbitrary code during processing.
Impact Analysis
The impact of CVE-2025-49113 is near-maximum severity, reflected in its CVSS score of 9.9. Confidentiality is fully compromised because server-side code execution enables the attacker to read any data accessible to the Roundcube web application process, including all user emails stored on the server, database credentials, IMAP/SMTP configuration secrets, session tokens for all active users, and potentially data from other applications hosted on the same server.
Integrity faces complete compromise as the attacker can modify the Roundcube application code, alter email content, inject backdoors, modify database records, and potentially compromise other web applications on the shared hosting environment. The Changed scope (S:C) is particularly significant here, as it means the attacker can affect resources beyond Roundcube itself, potentially compromising the entire server.
Availability is at maximum risk since the attacker can execute commands that disrupt the mail service, consume server resources, or destroy data. The exploitation path is particularly insidious because it only requires the victim to open an email, an action that users perform routinely and without suspicion. The attack is network-based (AV:N) with low complexity (AC:L), requiring only low privileges (PR:L) to send an email that reaches the target mailbox. No additional user interaction beyond opening the email is needed (UI:N), and the scope change amplifies the impact beyond the Roundcube application to the host system.
Exploit Maturity
CVE-2025-49113 exhibits extremely high exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 32.12% at the 96th percentile places it among the most actively exploited vulnerabilities currently tracked. This means that more than 96% of all known vulnerabilities have a lower exploitation probability.
Roundcube Webmail has historically been a target for sophisticated threat actors, including state-sponsored groups, due to its widespread deployment and the high value of email data. The GitHub issue tracking the vulnerability (roundcubemail#9562) and the official security advisory (Roundcube 1.6.9 release) provide details on the fix. The deserialization attack vector is well-understood in the security community, with numerous tools and techniques available for generating exploitation payloads for PHP deserialization vulnerabilities. The combination of a widely deployed target, a well-known attack technique, and confirmed active exploitation makes this vulnerability extremely urgent to address.
Remediation
Immediate upgrade to Roundcube Webmail version 1.5.8 or later (for the 1.5.x branch) or version 1.6.9 or later (for the 1.6.x branch) is critical. The security update released on July 15, 2025, addresses the deserialization vulnerability by implementing proper input validation and safe deserialization practices. The release notes at roundcube.net provide upgrade instructions.
Web Application Firewall (WAF) rules can provide a temporary layer of protection while patches are deployed. Configure rules to inspect email content for serialized PHP objects, particularly patterns matching O: prefixed strings that indicate PHP object serialization. However, WAF rules should be considered a temporary measure only, as attackers may find encoding techniques to bypass them.
Server-level hardening should be implemented to limit the blast radius of potential exploitation. Run Roundcube with minimal filesystem permissions, use a dedicated service account rather than a shared web server user, and implement mandatory access control frameworks such as SELinux or AppArmor to restrict what the web application process can access even if compromised.
Post-incident assessment is recommended for any Roundcube instance that was running a vulnerable version while exposed to the internet. Review server logs for indicators of compromise, check for unauthorized files or modifications to the Roundcube installation, and scan for web shells or other persistence mechanisms. Reset all user sessions and consider requiring password changes for all Roundcube users if compromise is suspected.
Technical Details
CVE-2025-49113 is a deserialization vulnerability in Roundcube Webmail's email processing pipeline. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting a network-accessible, low-complexity attack with changed scope and maximum impact. The only metric preventing a perfect 10.0 score is the requirement for low privileges (PR:L), meaning the attacker needs the ability to send an email that reaches the target Roundcube instance.
The vulnerability resides in how Roundcube processes certain email content structures. When an email containing specially crafted serialized data is processed by the Roundcube server, the application passes this data through PHP's unserialize() function without adequate validation. An attacker can construct a serialized PHP object payload that, when deserialized, triggers a chain of method calls across existing PHP classes in the Roundcube codebase and its dependencies (a technique known as POP chain or gadget chain exploitation).
The deserialization gadget chain ultimately achieves arbitrary code execution on the server with the privileges of the web server process. This typically means the attacker can execute system commands, read and write files, establish network connections, and interact with databases. The Changed scope (S:C) reflects that exploitation can impact resources beyond the Roundcube application, as the web server process may have access to other applications, databases, or services on the same host.
Affected versions include all Roundcube Webmail releases before 1.5.8 and all 1.6.x releases before 1.6.9. The fix introduces safe deserialization practices, including allowlisting of permitted classes for deserialization and proper validation of email content before it enters the deserialization pipeline.
Frequently Asked Questions
What is CVE-2025-49113?
CVE-2025-49113 is a critical remote code execution vulnerability in Roundcube Webmail caused by unsafe deserialization of crafted email content. An attacker can send a specially crafted email that, when processed by the server, executes arbitrary code.
How is CVE-2025-49113 exploited?
An attacker sends an email containing a specially crafted serialized PHP object to a Roundcube user. When the email is opened or processed by the server, the malicious payload is deserialized, triggering a chain of operations that results in arbitrary code execution on the server.
Which Roundcube versions are affected?
All Roundcube Webmail versions before 1.5.8 and all 1.6.x versions before 1.6.9 are vulnerable. Organizations should upgrade to at least version 1.5.8 or 1.6.9 to resolve this issue.
Why is CVE-2025-49113 rated 9.9 instead of 10.0?
The vulnerability scores 9.9 because it requires low privileges (the ability to send an email to the target) rather than no privileges. All other CVSS metrics are at their maximum severity, including changed scope and high impact on confidentiality, integrity, and availability.
Is CVE-2025-49113 being used in real attacks?
Yes. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog. Its EPSS score of 32.12% at the 96th percentile indicates it is among the most actively exploited vulnerabilities currently known.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.