Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

This flaw has been reported to have been exploited in the wild. Roundcube users should update as soon as possible.

Roundcube has been targeted by APT groups in the past. While no evidence of exploitation for this RCE have been found, we're monitoring this CVE for further updates

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0d6094a2-4095-11f0-8c92-00d861a0e66d advisory.

    Roundcube Webmail reports:
    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5934 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5934-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 02, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2025-49113

    It was discovered that missing input validation in RoundCube Webmail     could result in code execution.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.6.5+dfsg-1+deb12u5.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237740	FreeBSD : Post-Auth Remote Code Execution found in Roundcube Webmail (0d6094a2-4095-11f0-8c92-00d861a0e66d)	Nessus	FreeBSD Local Security Checks	critical
237664	Debian dsa-5934 : roundcube - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2025-49113

critical

Tenable Plugins

critical

critical