Critical 10-Year-Old Roundcube Webmail Bug Allows Authenticated Users Run Malicious Code
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37383 | Cross-Site Scripting in Roundcube Webmail via SVG animate attributes CVE-2024-37383 is a cross-site scripting vulnerability (CWE-79) in Roundcube Webmail caused by insufficient handling of SVG 'animate' attributes when HTML email content is rendered. An attacker triggers it by sending a crafted HTML email containing a malicious SVG animate element; when the recipient views the message in Roundcube, attacker-controlled JavaScript executes in the context of the victim's webmail session. Successful exploitation allows theft of session cookies and credentials, access to mailbox contents, sending mail as the victim, or redirection to phishing pages, and has been used in campaigns that steal credentials and email. All Roundcube Webmail deployments before 1.5.7 and 1.6.x before 1.6.7 are affected, including Roundcube packages shipped with Debian; because the attack requires only viewing a malicious email, any exposed webmail user is a potential victim. The flaw is under active exploitation: unknown threat actors have used it in phishing campaigns, it carries an EPSS of 73.3%, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-24. Do: Upgrade Roundcube to version 1.5.7 or 1.6.7 (or later) immediately; Debian users should install the updated roundcube package from their repository. Organizations subject to CISA BOD 22-01 must apply vendor mitigations or discontinue use per the KEV entry. Review webmail logs for phishing emails containing SVG animate elements and investigate for credential theft or anomalous mailbox activity. | 6.1 | 73% | KEV |
| masslikely millions of webmail users across hundreds of thousands of deployed instances, with tens of thousands of instances internet-exposed | |
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 contains a PHP object deserialization flaw (CWE-502) that allows remote code execution by authenticated users. The bug is in program/actions/settings/upload.php, where the _from URL parameter is not validated before deserialization, so any logged-in user can trigger it with a crafted URL to the settings upload action, with no user interaction required. Successful exploitation gives the attacker code execution on the web server with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). All deployments running affected versions are exposed, including Roundcube packages shipped with Debian Linux. The flaw reportedly existed for roughly a decade before disclosure, carries a 98.9% EPSS score (top percentile), and was added to CISA's KEV catalog on 2026-02-20, confirming exploitation in the wild. Do: Upgrade to Roundcube 1.6.11 or 1.5.10 (or later); Debian administrators should install the fixed roundcube package via security updates. Hunt for compromise by reviewing web access logs for requests to the settings upload action with unusual or crafted _from parameters, and check the web server runtime for unexpected processes, files, or webshells. Federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use of the product if mitigations are unavailable. | 8.8 | 99% | KEV PoC ×2 |
| masslikely tens of thousands of internet-exposed Roundcube instances serving millions of mailboxes |
Full article488 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 03, 2025Email Security / Vulnerability
Cybersecurity researchers have disclosed details of a critical security flaw in the Roundcube webmail software that has gone unnoticed for a decade and could be exploited to take over susceptible systems and execute arbitrary code.
The vulnerability, tracked as CVE-2025-49113, carries a CVSS score of 9.9 out of 10.0. It has been described as a case of post-authenticated remote code execution via PHP object deserialization.
"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization," reads the description of the flaw in the NIST's National Vulnerability Database (NVD).
The shortcoming, which affects all versions of the software before and including 1.6.10, has been addressed in 1.6.11 and 1.5.10 LTS. Kirill Firsov, founder and CEO of FearsOff, has been credited with discovering and reporting the flaw.
The Dubai-based cybersecurity company noted in a brief advisory that it intends to make public additional technical details and a proof-of-concept (PoC) "soon" so as to give users sufficient time to apply the necessary patches.
Previously disclosed security vulnerabilities in Roundcube have been a lucrative target for nation-state threat actors like APT28 and Winter Vivern. Last year, Positive Technologies revealed that unidentified hackers attempted to exploit a Roundcube flaw (CVE-2024-37383) as part of a phishing attack designed to steal user credentials.
Then a couple of weeks ago, ESET noted that APT28 had leveraged cross-site scripting (XSS) vulnerabilities in various webmail servers such as Roundcube, Horde, MDaemon, and Zimbra to harvest confidential data from specific email accounts belonging to governmental entities and defense companies in Eastern Europe.
Positive Technologies Reproduces CVE-2025-49113
Positive Technologies, in a post published on X, said it was able to reproduce CVE-2025-49113, urging users to update to the latest version of Roundcube as soon as possible.
"This vulnerability allows authenticated users to execute arbitrary commands via PHP object deserialization," the Russian cybersecurity company added.
CVE-2025-49113 PoC Released Amid Exploitation Attempts
FearsOff has released technical details of CVE-2025-49113 and a proof-of-concept (PoC) after reports of "active exploitation and evidence of the exploit being sold in underground forums." Describing it as an "email armageddon," the company said the vulnerability affects over 53 Million hosts.
The problem, according to Firsov, is rooted in the fact that starting a session variable name with an exclamation mark causes a session to get corrupted and the "$_GET['_from']" parameter used during image uploads for managing sender identities in Roundcube lacks as any sanitization, allowing an attacker to inject a malicious payload into the current session.
"This vulnerability is now known, exploitable, and being sold," Firsov said. "Consider monitoring file uploads, session activity, and other indicators tied to this attack vector."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/critical-10-year-old-roundcube-webmail.html