Roundcube post-auth RCE via PHP object deserialization in upload handler
Authenticated RCE in Roundcube before 1.5.10 and 1.6.x before 1.6.11 via unvalidated _from parameter triggering PHP object deserialization. CVSS 9.9. Patched June 2025.
- Vendor
- Roundcube
- Product
- Roundcube Webmail (before 1.5.10; 1.6.x before 1.6.11)
- CVSS
- 9.9
- EPSS (exploit probability)
- 97.7%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Remote code execution in Roundcube Webmail’s upload handler. The _from parameter in program/actions/settings/upload.php is not validated, enabling PHP object deserialization. Authenticated users — credentials obtained by any means, including through CVE-2024-42009 session-cookie theft — can trigger RCE with the privileges of the web server process.
Affected. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11.
Exploitation status. Active. Confirmed used by UNK_MassTraction (China-aligned, UNC5174 tooling overlap) as the second stage in a chain starting with CVE-2024-42009 XSS. Proofpoint documented the sequence: phishing email → XSS payload (IceCube) harvests session cookie → CVE-2025-49113 used with stolen session for RCE → SquareShell webshell or VShell drop → SNOWLIGHT ELF loader. Chain allows full server compromise from a single phishing email.
Patch. Roundcube 1.5.10 and 1.6.11. Released June 2025. No patch deployed means this chain is still live.
What to do. Upgrade immediately. Confirm the running version, not just the installed package. Audit for webshells (SquareShell or generic PHP) if the instance ran vulnerable versions during the May–July 2026 campaign window.
Sources. NVD CVE-2025-49113 · Proofpoint Threat Insight: UNK_MassTraction (via The Hacker News)
