CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users. The flaw arises because the _from parameter in a URL is not validated in program/actions/settings/upload.php. This matters for organizations that run Roundcube as their webmail interface, since an authenticated attacker can reach code execution on the server without needing additional privileges beyond a valid account.

How it works

The weakness is categorized as CWE-502, deserialization of untrusted data. An authenticated user supplies input through the _from parameter to the upload.php endpoint. The application performs deserialization on that input without validation, enabling the attacker to influence object reconstruction and achieve remote code execution.

Am I affected? How to find it in your systems

Roundcube Webmail is typically deployed on internal or perimeter web servers that provide browser-based email access. Inventory all hosts running the Roundcube package and examine the web root for the presence of program/actions/settings/upload.php. Confirm the installed version and any applied patches against the vendor advisory, as only specific releases address the parameter handling issue.

• Review web server access logs for requests to the upload.php path that contain unexpected values in the _from parameter.
• Check application logs for deserialization-related errors or unusual object reconstruction activity originating from authenticated sessions.
• Correlate any anomalous process creation or file writes on the web server with Roundcube worker processes.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, review configuration files to ensure that only necessary Roundcube features remain enabled and that the web application runs with the minimum required privileges.

• Restrict the Roundcube installation to trusted source IP ranges where operationally feasible.
• Ensure the underlying PHP environment uses current, supported versions and that opcode caching or serialization safeguards are active.

If you can't patch immediately

Follow the mitigations specified in the vendor instructions. For cloud-hosted instances, apply any applicable guidance from CISA BOD 22-01. If mitigations cannot be implemented, discontinue use of the affected Roundcube deployment until an update can be applied.

• Place the webmail server behind a network segmentation boundary that limits outbound connections and administrative access.
• Monitor authentication events and web request patterns for the affected endpoint until the patch is deployed.

If your data may have been exposed

Deserialization vulnerabilities that permit code execution have been used to compromise systems. Organizations can run a free exposure scan of their email addresses against known breach data to determine whether any accounts appear in public breach records.