Meta News

Security researchers are warning organizations to urgently patch a critical vulnerability in Roundcube Webmail after observing attackers actively scanning the internet for vulnerable installations.

The flaw, tracked as CVE-2025-49113, affects Roundcube versions before 1.5.10 and 1.6.11 and can allow authenticated attackers to execute arbitrary code on the underlying server. With a CVSS score of 9.9, it represents a serious risk for organizations operating exposed Roundcube servers.

The vulnerability is particularly notable because it reportedly existed in Roundcube’s codebase for roughly a decade before being identified and patched.

CVE-2025-49113 is caused by improper handling of user-controlled input during PHP object deserialization.

An attacker needs valid Roundcube credentials, but successful exploitation can escalate a compromised mailbox into something considerably more serious:remote code execution on the webmail server.

That requirement does not provide much protection against determined attackers. Credentials can be obtained through phishing, password reuse, infostealer malware, credential stuffing, or previous compromises.

Once authenticated, an attacker can send specially crafted requests that exploit the vulnerable deserialization process.

This makes the flaw useful as a second stage of an intrusion. Instead of remaining limited to reading someone’s email, an attacker who already possesses credentials can potentially compromise the infrastructure hosting the webmail application.

Threat monitoring organizations have detected increased scanning activity looking for Roundcube installations that may still be vulnerable.

This type of reconnaissance frequently follows the publication of technical vulnerability details or proof-of-concept exploit code. Attackers scan large ranges of internet-facing systems, identify potentially vulnerable versions, and return later with credentials or exploitation attempts.

Roundcube is an attractive target because it is widely deployed by hosting providers, universities, government organizations, and businesses.

Webmail systems also contain particularly valuable information. A compromised mailbox can expose password-reset links, internal conversations, confidential attachments, contact information, and credentials sent through email.

Server-level access significantly increases that risk.

One of the most striking aspects of CVE-2025-49113 is how long the underlying vulnerability remained unnoticed.

Researchers reported that the vulnerable code had been present for approximately 10 years.

The issue was discovered by security researcher Kirill Firsov, who privately reported it to the Roundcube project. Fixes were subsequently released in versions 1.5.10 and 1.6.11.

The long exposure period illustrates a persistent problem in mature software projects: vulnerabilities can survive extensive real-world use and years of development without being detected.

Once discovered, however, attackers can analyze the patch and rapidly develop exploitation techniques.

Roundcube vulnerabilities have repeatedly attracted the attention of sophisticated threat actors.

The platform has been targeted in espionage campaigns because compromising webmail provides direct access to sensitive communications without requiring attackers to compromise every user’s endpoint individually.

Government agencies, political organizations, research institutions, and other high-value targets frequently operate webmail infrastructure, making vulnerabilities in these platforms useful for intelligence collection.

Roundcube has previously addressed cross-site scripting and other vulnerabilities that were subsequently exploited in targeted attacks.

That history makes active scanning for CVE-2025-49113 particularly concerning.

Organizations sometimes prioritize unauthenticated vulnerabilities over flaws requiring an existing account.

CVE-2025-49113 demonstrates why that distinction can be misleading.

Email credentials are routinely stolen, and compromising one account normally provides access only to that user’s mailbox. A vulnerability capable of turning those credentials into code execution can dramatically increase the impact of the initial compromise.

This is particularly dangerous in shared environments where one Roundcube installation provides webmail services for many users or organizations.

Attackers could potentially move from a compromised identity toward control of the underlying application server.

Administrators running Roundcube should verify their installed version and upgrade to a supported release containing the security fix.

Systems running versions older than 1.5.10 or 1.6.11 should be treated as potentially vulnerable.

Because attackers are already scanning for exposed installations, patching should be prioritized rather than delayed until direct exploitation attempts are detected.

Administrators should also review authentication logs and web server activity for suspicious behavior, particularly when internet-facing Roundcube installations have remained unpatched since technical details of the vulnerability became public.

The incident demonstrates a recurring pattern in vulnerability management.

A flaw can remain hidden for years, but once disclosed, the window between public knowledge and widespread attacker interest can become extremely short.

For internet-facing services such as webmail, that makes rapid patching one of the most important defenses available.