Roundcube RCE: Dark web activity signals imminent attacks (CVE-2025-49113)

CVE-2024-42009 is a cross-site scripting (CWE-79) vulnerability in Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7, caused by a desanitization issue in message_body() in program/actions/mail/show.php. An attacker sends a specially crafted email, and when the victim opens it in the Roundcube interface, injected script runs in the context of the victim's webmail session (no privileges are required, but user interaction is needed, per the CVSS UI:R vector). Successful exploitation lets the attacker steal the victim's emails and send messages as the victim, and related reporting notes that, chained with the companion flaw CVE-2024-42008, attackers can compromise email accounts and passwords. Any organization or provider self-hosting an affected Roundcube version is exposed, including universities, hosting providers, enterprises, and government mail systems. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-06-09, EPSS is 82.9% (100th percentile), and recent headlines describe suspected China-aligned espionage activity using Roundcube exploit chains against universities.

Do: Upgrade Roundcube to a point release newer than 1.6.7 on the 1.6.x line or newer than 1.5.7 on the 1.5.x line (the latest vendor release of each branch), per vendor instructions; organizations under BOD 22-01 must apply the required mitigations by the KEV due date or discontinue use. Also patch the companion issue CVE-2024-42008 to prevent chained account compromise. Review webmail access logs for suspicious requests to the mail show handler, check sent-mail folders for messages sent unexpectedly as users, and rotate sessions/credentials for potentially targeted accounts.

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 contains a PHP object deserialization flaw (CWE-502) that allows remote code execution by authenticated users. The bug is in program/actions/settings/upload.php, where the _from URL parameter is not validated before deserialization, so any logged-in user can trigger it with a crafted URL to the settings upload action, with no user interaction required. Successful exploitation gives the attacker code execution on the web server with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). All deployments running affected versions are exposed, including Roundcube packages shipped with Debian Linux. The flaw reportedly existed for roughly a decade before disclosure, carries a 98.9% EPSS score (top percentile), and was added to CISA's KEV catalog on 2026-02-20, confirming exploitation in the wild.

Do: Upgrade to Roundcube 1.6.11 or 1.5.10 (or later); Debian administrators should install the fixed roundcube package via security updates. Hunt for compromise by reviewing web access logs for requests to the settings upload action with unusual or crafted _from parameters, and check the web server runtime for unexpected processes, files, or webshells. Federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use of the product if mitigations are unavailable.

Roundcube Webmail contains a cross-site scripting flaw (CWE-79) that arises when rendering SVG documents, because the SVG 'animate' element is not properly sanitized. An attacker can deliver a crafted SVG document, for example within an email, so that when the recipient views it in the Roundcube web interface, attacker-controlled script executes in the context of the victim's webmail session. Successful exploitation lets the attacker run arbitrary JavaScript in the victim's browser, enabling session hijacking, theft of cookies or credentials, and reading or manipulating the victim's mail and webmail settings. Any organization running Roundcube is potentially affected, including hosting providers, ISPs, universities, and enterprises, where it frequently serves as the default webmail client. CISA added the flaw to the KEV catalog on 2026-02-20, indicating confirmed in-the-wild exploitation, with a 26.8% EPSS probability of exploitation within 30 days (98th percentile); CVSS has not yet been scored and no public proof-of-concept is known.

Do: Upgrade Roundcube to the patched release identified in the vendor's security advisory, and for cPanel-managed servers apply the cPanel-shipped Roundcube update; do not defer patching given active exploitation. Until patched, apply vendor-recommended mitigations and hunt mail and web access logs for emails containing SVG content followed by anomalous webmail session activity. Federal agencies must apply the mitigations per vendor instructions or follow BOD 22-01 guidance per the CISA KEV listing.