roundcubemail: Remote Code Execution in Roundcube via Unvalidated _from Parameter
CVSS score
9.9
EPSS probability
%99.0
Risk score
19.6
Published
1 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Roundcube 1.6.10 - Remote Code Execution (RCE)
Nuclei: Roundcube Webmail - Remote Code Execution
Python Script for CVE-2025-49113. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt.
CVE-2025-49113 - Roundcube Remote Code Execution
Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization
Roundcube Webmail post-auth RCE via PHP object deserialization (CVE-2025-49113)
CVE-2025-49113 – Roundcube ≤1.6.10 post-auth RCE via PHP object deserialization (HackTheBox CTF)
Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-
Similar Vulnerabilities
roundcubemail: A Cross-Site Scripting vulnerability in Roundcube
roundcubemail: potential SQL injection via search or search_params.
roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
roundcubemail: XSS via a malicious XML attachment
roundcube: cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages
roundcubemail: XSS via HTML or plain text messages with malicious content
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-49113"