Roundcube Webmail before 1

CVE-2025-49113 is a PHP object deserialization flaw in Roundcube's file upload handler (program/actions/settings/upload.php). The _from request parameter is passed to unserialize() after being fetched from session state without validation, letting an authenticated user instantiate arbitrary PHP objects and trigger destructor/magic-method gadget chains that end in command execution as the web server user. The bug has lived in the codebase for over ten years and affects Roundcube 1.1.0 through 1.5.9 and 1.6.0 through 1.6.10. Fixed in 1.5.10 and 1.6.11 (June 1, 2025).

Vendor's 9.9 CRITICAL rating is accurate and if anything conservative. Yes, PR:L (low-privilege auth required) normally warrants a downgrade — but Roundcube is the *default* webmail on cPanel, Plesk, ISPConfig, and countless shared-hosting stacks, meaning tens of thousands of instances are internet-facing with self-service user accounts, and valid credentials are a commodity on infostealer markets. CISA added it to KEV on June 30, 2025, weaponized exploits were being sold within 48 hours of the FEARSOFF advisory, and mass scanning began the same week. This is the rare case where the friction (auth requirement) is neutralized by the deployment model.

Why this verdict

• KEV + EPSS 0.89 — this is not theoretical. CISA listed it within 4 weeks of disclosure and EPSS is in the top-1% band because exploitation is *measured*, not predicted.
• Role multiplier — webmail plane: Roundcube's canonical role is the customer-facing mail UI for hosting providers (cPanel, Plesk, ISPConfig ship it by default). Chain succeeds in that role → outcome is per-tenant RCE + IMAP credential harvest + session theft across every mailbox on the vhost. This is the fleet-scale outcome and it dominates the verdict.
• PR:L friction is nullified by the deployment model — hosting providers *sell* accounts, and infostealer markets sell mailbox creds for pennies. On multi-tenant hosts the auth requirement is a $2 speed bump, not a defense.
• Ten-year bug window means 100% of unpatched instances on any version between 1.1.0 and 1.6.10 are vulnerable — no narrow band to hide in.
• Public weaponized exploits in Metasploit, Nuclei, and standalone Python — no skill barrier.

Why not higher?

There is no higher bucket than CRITICAL, but note the score sits at 9.4 rather than 10.0 because PR:L is still a real friction on properly-segmented enterprise deployments (SSO-fronted webmail with no self-service signup), and because a single Roundcube RCE does not automatically pivot to domain-level compromise the way an AD or hypervisor bug would.

Why not lower?

Downgrading to HIGH would require ignoring the KEV listing and the observed mass exploitation of ~120k exposed instances. The PR:L auth requirement, which normally justifies a downgrade, is defeated in practice by infostealer credential markets and self-service signup on hosting stacks — so it cannot be treated as meaningful friction here.

1. Restrict /mail, /webmail, /roundcube to VPN or IP allowlist at the reverse proxy — Kills the credential-brute-force and self-service-signup path. Deploy within 3 days per noisgate mitigation SLA — Nginx allow/deny or Cloudflare Access rule takes <1 hour.
2. Deploy WAF rule blocking PHP serialized object markers in POST bodies to Roundcube endpoints — ModSecurity/CRS rule matching regex (?:^|[&;])_from=[^&]*O%3A\d+%3A blocks the exploit payload. Turn on within 3 days; low false-positive risk since users don't submit serialized objects.
3. Force session revocation and password reset for all Roundcube users — If you've been exposed for >30 days, assume some sessions/creds are compromised. Truncate the session table, rotate the des_key in config.inc.php, force IMAP password reset. Do this at the same time as the patch.
4. Upgrade to 1.5.10 or 1.6.11 (or distro backport) — The only durable fix. Debian apt install roundcube, EPEL dnf update roundcubemail, or upstream tarball. Within 90 days per noisgate remediation SLA — realistically do it in the first maintenance window.
5. Enable MFA in front of Roundcube via reverse-proxy SSO — Roundcube's built-in twofactor_gauthenticator plugin does not gate the vulnerable code path — put MFA at the *proxy* layer (Authelia, oauth2-proxy, Cloudflare Access). Kills 90% of stolen-credential replays.

Run on each Roundcube host as any user with read on the install directory. Invoke as ./check_cve_2025_49113.sh /var/www/roundcube (default path /var/www/html/roundcube if none given). No root required unless the install dir is mode 0700. Exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN.

#!/usr/bin/env bash
# noisgate check: CVE-2025-49113 Roundcube deserialization RCE
# Usage: ./check_cve_2025_49113.sh [/path/to/roundcube]
set -u

ROOT="${1:-/var/www/html/roundcube}"
VERFILE="$ROOT/program/include/iniset.php"
ALT="$ROOT/index.php"

if [[ ! -d "$ROOT" ]]; then
  echo "UNKNOWN: $ROOT not found"
  exit 2
fi

# Extract RCMAIL_VERSION
VER=$(grep -hRE "define\(['\"]RCMAIL_VERSION['\"]" "$ROOT/program/include/" "$ROOT/" 2>/dev/null \
      | grep -oE "[0-9]+\.[0-9]+\.[0-9]+" | head -n1)

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse RCMAIL_VERSION in $ROOT"
  exit 2
fi

echo "Detected Roundcube version: $VER"

# Compare semver. Vulnerable: 1.1.0 <= v < 1.5.10, or 1.6.0 <= v < 1.6.11
IFS='.' read -r MAJ MIN PAT <<< "$VER"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

vulnerable=0
if (( MAJ == 1 )); then
  if (( MIN >= 1 && MIN <= 5 )); then
    # 1.1.x - 1.5.x: fixed at 1.5.10
    if (( MIN < 5 )) || (( MIN == 5 && PAT < 10 )); then
      vulnerable=1
    fi
  elif (( MIN == 6 )); then
    # 1.6.x: fixed at 1.6.11
    if (( PAT < 11 )); then
      vulnerable=1
    fi
  fi
fi

# Secondary check: look for the pre-patch unserialize call
UPLOAD="$ROOT/program/actions/settings/upload.php"
if [[ -f "$UPLOAD" ]]; then
  if grep -qE "unserialize\(.*_from" "$UPLOAD" 2>/dev/null; then
    echo "Confirmed: unpatched unserialize(_from) sink present."
    vulnerable=1
  fi
fi

if (( vulnerable == 1 )); then
  echo "VULNERABLE: Roundcube $VER is affected by CVE-2025-49113. Upgrade to 1.5.10 or 1.6.11."
  exit 1
fi

echo "PATCHED: Roundcube $VER is not affected."
exit 0

Sources

1. Roundcube 1.6.11 / 1.5.10 release notes
2. FEARSOFF advisory (Kirill Firsov)
3. CISA KEV entry
4. NVD — CVE-2025-49113
5. watchTowr Labs write-up
6. Debian security tracker
7. hakaioffensive PoC
8. GreyNoise tag — Roundcube RCE Attempt