Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

A China-aligned threat cluster, UNK_MassTraction, has been linked to exploitation of known Roundcube vulnerabilities. Apply the available patches as soon as possible.

This flaw has been reported to have been exploited in the wild. Roundcube users should update as soon as possible.

Roundcube has been targeted by APT groups in the past. While no evidence of exploitation for this RCE have been found, we're monitoring this CVE for further updates

According to its self-reported version number, Roundcube Webmail is prior to 1.5.10 or 1.6.x prior to 1.6.11. Therefore, it may be affected by a Remote code execution vulnerability by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization (CVE-2025-49113).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated
    users because the _from parameter in a URL is not validated in program/actions/settings/upload.php,
    leading to PHP Object Deserialization. (CVE-2025-49113)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0466 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-49113:
    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated     users because the _from parameter in a URL is not validated in program/actions/settings/upload.php,     leading to PHP Object Deserialization.

    CVE-2024-42009:
    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote     attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization     issue in message_body() in program/actions/mail/show.php.

    CVE-2024-42008:
    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x     through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail     attachment served with a dangerous Content-Type header.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7584-1 advisory.

    It was discovered that Roundcube Webmail did not properly sanitize the _from parameter in a URL, leading     to PHP Object Deserialization. A remote attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70701de9de advisory.

    This is a **security update** to the stable version 1.6 of Roundcube Webmail.
    It provides fixes to recently reported security vulnerabilities:

    *    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.

    This version is considered stable and we recommend to update all productive installations of Roundcube     1.6.x with it. Please do backup your data before updating!

    CHANGELOG

    *    Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
    *    Improve installer to fix confusion about disabling SMTP authentication (#9801)
    *    Fix PHP warning in index.php (#9813)
    *    OAuth: Fix/improve token refresh
    *    Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
    *    Fix HTML message preview if it contains floating tables (#9804)
    *    Fix removing/expiring redis/memcache records when using a key prefix
    *    Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-     type (#9781)
    *    Fix a default value and documentation of password_ldap_encodage option (#9658)
    *    Remove mobile/floating Create button from the list in Settings > Folders (#9661)
    *    Fix Delete and Empty buttons state while creating a folder (#9047)
    *    Fix connecting to LDAP using ldapi:// URI (#8990)
    *    Fix cursor position on below the quote reply in HTML mode (#8700)
    *    Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-a5f56fe8ff advisory.

    This is a **security update** to the stable version 1.6 of Roundcube Webmail.
    It provides fixes to recently reported security vulnerabilities:

    *    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.

    This version is considered stable and we recommend to update all productive installations of Roundcube     1.6.x with it. Please do backup your data before updating!

    CHANGELOG

    *    Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
    *    Improve installer to fix confusion about disabling SMTP authentication (#9801)
    *    Fix PHP warning in index.php (#9813)
    *    OAuth: Fix/improve token refresh
    *    Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
    *    Fix HTML message preview if it contains floating tables (#9804)
    *    Fix removing/expiring redis/memcache records when using a key prefix
    *    Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-     type (#9781)
    *    Fix a default value and documentation of password_ldap_encodage option (#9658)
    *    Remove mobile/floating Create button from the list in Settings > Folders (#9661)
    *    Fix Delete and Empty buttons state while creating a folder (#9047)
    *    Fix connecting to LDAP using ldapi:// URI (#8990)
    *    Fix cursor position on below the quote reply in HTML mode (#8700)
    *    Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4211 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4211-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     June 09, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : roundcube     Version        : 1.4.15+dfsg.1-1+deb11u5     CVE ID         : CVE-2025-49113     Debian Bug     : 1107073

    Kirill Firsov discovered that Roundcube, a skinnable AJAX based webmail     solution for IMAP servers, was performing PHP Object deserialization on     unvalidated input, which could lead to remote code execution by an     authenticated attacker.

    For Debian 11 bullseye, these problems have been fixed in version     1.4.15+dfsg.1-1+deb11u5.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0d6094a2-4095-11f0-8c92-00d861a0e66d advisory.

    Roundcube Webmail reports:
    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5934 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5934-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 02, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2025-49113

    It was discovered that missing input validation in RoundCube Webmail     could result in code execution.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.6.5+dfsg-1+deb12u5.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115139	Roundcube Webmail 1.6.x < 1.6.11 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	high
115138	Roundcube Webmail < 1.5.10 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	high
436481	SCA: security update for roundcube/roundcubemail (GHSA-8j8w-wwqc-x596)	Tenable Cloud Security	SCA Checks	Local	high
436481	SCA: security update for roundcube/roundcubemail (GHSA-8j8w-wwqc-x596)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
275923	TencentOS Server 4: roundcubemail (TSSA-2025:0466)	Nessus	Tencent Local Security Checks	Local	critical
240494	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Roundcube vulnerability (USN-7584-1)	Nessus	Ubuntu Local Security Checks	Local	high
238291	Fedora 42 : roundcubemail (2025-70701de9de)	Nessus	Fedora Local Security Checks	Local	high
238230	Fedora 41 : roundcubemail (2025-a5f56fe8ff)	Nessus	Fedora Local Security Checks	Local	high
237972	Debian dla-4211 : roundcube - security update	Nessus	Debian Local Security Checks	Local	high
237740	FreeBSD : Post-Auth Remote Code Execution found in Roundcube Webmail (0d6094a2-4095-11f0-8c92-00d861a0e66d)	Nessus	FreeBSD Local Security Checks	Local	high
237664	Debian dsa-5934 : roundcube - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2025-49113

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high