Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

This flaw has been reported to have been exploited in the wild. Roundcube users should update as soon as possible.

Roundcube has been targeted by APT groups in the past. While no evidence of exploitation for this RCE have been found, we're monitoring this CVE for further updates

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7584-1 advisory.

    It was discovered that Roundcube Webmail did not properly sanitize the _from parameter in a URL, leading     to PHP Object Deserialization. A remote attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70701de9de advisory.

    This is a **security update** to the stable version 1.6 of Roundcube Webmail.
    It provides fixes to recently reported security vulnerabilities:

    *    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.

    This version is considered stable and we recommend to update all productive installations of Roundcube     1.6.x with it. Please do backup your data before updating!

    CHANGELOG

    *    Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
    *    Improve installer to fix confusion about disabling SMTP authentication (#9801)
    *    Fix PHP warning in index.php (#9813)
    *    OAuth: Fix/improve token refresh
    *    Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
    *    Fix HTML message preview if it contains floating tables (#9804)
    *    Fix removing/expiring redis/memcache records when using a key prefix
    *    Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-     type (#9781)
    *    Fix a default value and documentation of password_ldap_encodage option (#9658)
    *    Remove mobile/floating Create button from the list in Settings > Folders (#9661)
    *    Fix Delete and Empty buttons state while creating a folder (#9047)
    *    Fix connecting to LDAP using ldapi:// URI (#8990)
    *    Fix cursor position on below the quote reply in HTML mode (#8700)
    *    Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-a5f56fe8ff advisory.

    This is a **security update** to the stable version 1.6 of Roundcube Webmail.
    It provides fixes to recently reported security vulnerabilities:

    *    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v.

    This version is considered stable and we recommend to update all productive installations of Roundcube     1.6.x with it. Please do backup your data before updating!

    CHANGELOG

    *    Managesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
    *    Improve installer to fix confusion about disabling SMTP authentication (#9801)
    *    Fix PHP warning in index.php (#9813)
    *    OAuth: Fix/improve token refresh
    *    Fix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
    *    Fix HTML message preview if it contains floating tables (#9804)
    *    Fix removing/expiring redis/memcache records when using a key prefix
    *    Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-     type (#9781)
    *    Fix a default value and documentation of password_ldap_encodage option (#9658)
    *    Remove mobile/floating Create button from the list in Settings > Folders (#9661)
    *    Fix Delete and Empty buttons state while creating a folder (#9047)
    *    Fix connecting to LDAP using ldapi:// URI (#8990)
    *    Fix cursor position on below the quote reply in HTML mode (#8700)
    *    Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4211 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4211-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     June 09, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : roundcube     Version        : 1.4.15+dfsg.1-1+deb11u5     CVE ID         : CVE-2025-49113     Debian Bug     : 1107073

    Kirill Firsov discovered that Roundcube, a skinnable AJAX based webmail     solution for IMAP servers, was performing PHP Object deserialization on     unvalidated input, which could lead to remote code execution by an     authenticated attacker.

    For Debian 11 bullseye, these problems have been fixed in version     1.4.15+dfsg.1-1+deb11u5.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0d6094a2-4095-11f0-8c92-00d861a0e66d advisory.

    Roundcube Webmail reports:
    Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5934 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5934-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 02, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2025-49113

    It was discovered that missing input validation in RoundCube Webmail     could result in code execution.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.6.5+dfsg-1+deb12u5.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240494	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Roundcube vulnerability (USN-7584-1)	Nessus	Ubuntu Local Security Checks	critical
238291	Fedora 42 : roundcubemail (2025-70701de9de)	Nessus	Fedora Local Security Checks	critical
238230	Fedora 41 : roundcubemail (2025-a5f56fe8ff)	Nessus	Fedora Local Security Checks	critical
237972	Debian dla-4211 : roundcube - security update	Nessus	Debian Local Security Checks	critical
237740	FreeBSD : Post-Auth Remote Code Execution found in Roundcube Webmail (0d6094a2-4095-11f0-8c92-00d861a0e66d)	Nessus	FreeBSD Local Security Checks	critical
237664	Debian dsa-5934 : roundcube - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2025-49113

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical