Roundcube Webmail Remote Code Execution (CVE-2025-49113)

Historical catalog analysis: CISA added this entry on February 20, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-49113 is a deserialization of untrusted data vulnerability (CWE-502) identified in Roundcube Webmail. The flaw exists because the _from parameter within a URL is not properly validated in the program/actions/settings/upload.php component. If successfully exploited, this could allow an authenticated user to execute arbitrary code on the server.

Exposure and applicability

This vulnerability applies to Roundcube Webmail deployments utilizing the affected upload.php functionality. A critical prerequisite for exploitation is that the attacker must be an authenticated user; unauthenticated remote access is not supported by the source data. Organizations running versions prior to the security updates released in June 2025 are potentially exposed.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog, remediation should be prioritized for all internet-facing webmail infrastructure. Our analysis suggests the following priority sequence:

1. Update Software: Deploy security updates 1.6.11 or 1.5.10 as provided by the vendor to address the lack of validation in the _from parameter.
2. Access Review: Since authentication is required for exploitation, auditing active user accounts and enforcing strict access controls could reduce the pool of potential internal threats while patching is underway.
3. Component Isolation: If immediate patching is not feasible, defenders should evaluate if the specific functionality within program/actions/settings/upload.php can be restricted or disabled without disrupting core business operations.

How to validate remediation

Verification must go beyond a simple version check of the application binary. To ensure exposure is reduced, vulnerability management teams should:

• Verify Component Integrity: Confirm that the specific file program/actions/settings/upload.php has been updated to the versions associated with releases 1.6.11 or 1.5.10.
• Configuration Audit: Ensure that no legacy or backup copies of the vulnerable component remain accessible in the web root.

Confirmation of a version update indicates the patch was applied, but it does not guarantee that the environment is free of other configuration-based exposures.

Limits and open questions

While CISA has added this to the KEV catalog, the source lists known ransomware campaign use as “Unknown.” It remains unclear if there are public exploit payloads available or if exploitation requires specific server-side configurations beyond the base vulnerability. Additionally, because this is an authenticated RCE, the residual risk depends heavily on the organization’s identity management and session timeout policies.

Source and editorial note

CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability · Source date: February 20, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 23, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 20, 2026 at 00:11 UTC.

Request a Vulnerability Assessment