Roundcube Webmail under fire critical exploit found after a decade

A critical flaw, tracked as CVE-2025-49113 (CVSS score of 9.9), has been discovered in the Roundcube webmail software. The vulnerability went unnoticed for over a decade, allowing an attacker to exploit the flaw to take control of affected systems and run malicious code, putting users and organizations at significant risk. Kirill Firsov, founder and CEO of FearsOff, discovered the vulnerability.

“Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization,” reads the advisory published by NIST.

The vulnerability has been addressed in versions 1.6.11 and 1.5.10 LTS.

Firsov estimates that the flaw impacts over 53 million hosts (including tools such as cPanel, Plesk, ISPConfig, DirectAdmin, etc.), and he noted that details and proof of concept will be published soon.

To read the complete article, see: Security Affairs
See more here: NVD Details