Critical Vulnerability in Roundcube Webmail Exposes Systems to Remote Code Execution
On June 3, 2025, cybersecurity researchers revealed a significant security vulnerability in the Roundcube webmail software, a flaw that has remained undetected for a decade. This vulnerability has the potential to be exploited by authenticated users, compromising affected systems and allowing for the execution of arbitrary code. The security issue, identified as CVE-2025-49113, has been assigned an alarming CVSS score of 9.9 out of 10.0, underscoring its severity.
The vulnerability arises from a lack of validation for the “_from” parameter in a specific URL within the program’s upload settings file, actions/settings/upload.php. This oversight facilitates post-authentication remote code execution through PHP object deserialization, making it particularly concerning as it can be triggered by users who are already authenticated within the system. The flaw affects all versions of Roundcube prior to and including 1.6.10, and it has been rectified in versions 1.6.11 and 1.5.10 LTS.
The implications of such a vulnerability are vast, as any authenticated user could potentially manipulate the underlying systems for malicious purposes. Kirill Firsov, founder and CEO of FearsOff, is credited with discovering this critical flaw, prompting the urgent need for organizations using Roundcube to update their software to secure their environments.
The targeted audience primarily includes organizations that rely on Roundcube for their webmail solutions. While specific organizations are not disclosed, the vulnerability poses risks to any business utilizing this software, and its implications extend across sectors where digital communication is essential.
In terms of potential attack vectors, the MITRE ATT&CK framework provides insights into the tactics that adversaries may exploit in such scenarios. Initial access could be gained through valid credentials, leveraging the authenticated state to execute arbitrary code. Persistence might be established if the vulnerability were used to implant additional malicious payloads or scripts within the compromised environment. Such actions could further escalate privileges and allow attackers to maintain a foothold within the affected systems.
Organizations are urged to review their Roundcube installations critically and ensure that they are operating on the latest secure versions. With cyber threats continually evolving, maintaining updated software and understanding the vulnerabilities inherent in widely-used applications like Roundcube is paramount for safeguarding sensitive information and maintaining operational integrity in today’s digital landscape.
