CVE-2025-49113: Roundcube Webmail Deserialization -- Authenticated RCE via upload.php

Background

Roundcube Webmail is one of the most widely deployed open-source webmail clients, used by internet service providers, enterprises, universities, and hosting providers globally. It provides a browser-based interface to IMAP email accounts and is frequently the webmail component in cPanel/WHM-based hosting environments, ISP email services, and university email systems. Roundcube is estimated to be deployed on millions of servers, many of which are internet-facing by design.

Roundcube has been a recurring target for sophisticated threat actors. The Russian state-sponsored group APT28 (Fancy Bear) has previously exploited Roundcube vulnerabilities (including CVE-2020-35730 and CVE-2023-43770) to target governmental and diplomatic organisations. Given that Roundcube is the interface through which users access sensitive email communications, its compromise is particularly valuable for espionage. CISA added CVE-2025-49113 to the KEV catalogue on 2026-02-20.

Technical Mechanism

CVE-2025-49113 is a PHP deserialisation vulnerability in Roundcube’s upload.php script, specifically in the handling of the _from parameter.

PHP’s unserialize() function reconstructs PHP objects from a string representation. When called on attacker-controlled input, it can trigger the instantiation of arbitrary PHP classes available in the application’s namespace — a vulnerability known as PHP Object Injection. If any of those classes implements “magic methods” (__wakeup, __destruct, __toString) that perform dangerous operations, an attacker can chain these into a PHP Object Injection gadget chain that achieves code execution.

The attack flow is as follows:

1. An attacker authenticates to Roundcube with any valid user account (the authentication requirement is low — attackers may use compromised credentials, default credentials, or accounts obtained via phishing)
2. The attacker sends a crafted POST request to upload.php with a malicious PHP serialised object as the value of the _from parameter
3. Roundcube passes the _from value to unserialize() without first verifying its content
4. During deserialisation, a PHP Object Injection gadget chain is triggered
5. The gadget chain executes arbitrary PHP code, typically invoking OS commands through system(), exec(), or proc_open()
6. The attacker achieves RCE under the web server process context (e.g., www-data)

The authenticated-but-low-privilege requirement means any valid Roundcube account — including free trial or low-privilege accounts at hosting providers — can be used to exploit the vulnerability.

Real-World Exploitation Evidence

CVE-2025-49113 was added to CISA KEV on 2026-02-20. Roundcube exploitation history is significant:

• APT28 (Fancy Bear / GRU) — Russian military intelligence has repeatedly used Roundcube vulnerabilities to target European government, military, and NGO email accounts; this group is expected to adopt new Roundcube vulnerabilities rapidly
• Phishing chain attacks — attackers first phish for Roundcube credentials (often via convincing login page clones), then use the credentials to exploit server-side vulnerabilities like CVE-2025-49113 for full server compromise
• ISP and hosting provider impact — Roundcube instances at hosting providers may serve thousands of customers; server-side compromise can affect all tenants

Impact Assessment

CVE-2025-49113 is exploitable by any valid Roundcube account holder, making the authentication prerequisite a low barrier in practice. Hosting providers and ISPs running Roundcube routinely issue accounts to large numbers of users, and compromised email credentials are widely available on criminal marketplaces. A successful exploit achieves PHP code execution under the web server user, providing access to Roundcube’s configuration files (which contain IMAP and database credentials), the ability to install persistent PHP web shells, and visibility into the email storage accessible to the server process. The 8.8 CVSS score reflects the authenticated requirement while acknowledging the high impact of the resulting RCE.

The broader impact is shaped by Roundcube’s role as shared infrastructure. At ISPs and hosting providers, a single Roundcube instance serves many customers: server-level compromise can expose email content, credentials, and contact data for all tenants. For government and NGO targets, the value is intelligence: email archives accessible from a compromised Roundcube server may contain diplomatic communications, policy discussions, and sensitive organisational data. APT28’s repeated return to Roundcube vulnerabilities underscores the platform’s value as an espionage target. Even at organisations that are not high-profile espionage targets, email access provides attackers with business email compromise opportunities, credential phishing templates, and internal context useful for social engineering.

Affected Versions

Consult the Roundcube GitHub repository and official announcements for precise version information.

Remediation Steps

1. Update Roundcube to the latest patched release:

   # Via Roundcube updater or manual upgrade
   php -r "copy('https://roundcube.net/download', 'rc-download');"

2. As an immediate mitigation, consider adding input validation at the web server layer to reject requests to upload.php with non-standard _from parameter values
3. Rotate all service account credentials used by the Roundcube installation:
   • Database credentials in config/config.inc.php
   • SMTP/IMAP authentication credentials
4. Review web server access logs for POST requests to upload.php with large or binary _from parameter values
5. Search for unexpected PHP files in the Roundcube installation directory and web root:

   find /var/www/roundcubemail -name "*.php" -newer /var/www/roundcubemail/index.php -type f

6. If hosted at a shared hosting provider, notify the provider and request investigation
7. Review the hosting server for signs of broader compromise if Roundcube runs with shared-server privileges

Detection Guidance

Web server access logs (Apache/Nginx) — look for:

• POST requests to upload.php with abnormally large _from parameter values
• Requests to upload.php from unexpected source IP addresses at unusual times
• Access to newly created .php files in Roundcube directories following the exploitation window

PHP application logs:

• PHP unserialise errors or exceptions from upload.php
• Unusual class instantiation in Roundcube PHP logs

SIEM query example (Splunk):

index=web_logs sourcetype=apache_access
| search cs_uri_stem="*/upload.php" cs_method="POST"
| eval param_len=len(cs_uri_query)
| where param_len > 500 OR match(cs_post_body, "O:[0-9]+:")
| stats count by c_ip, cs_uri_stem, param_len, sc_status
| sort -count

OS-level indicators:

• Processes spawned by the web server user (www-data, apache) that are not typical PHP/web operations
• Outbound connections from the Roundcube server to external IP addresses

Timeline

References

• NVD — CVE-2025-49113
• CISA KEV — CVE-2025-49113
• Roundcube Security Advisory — CVE-2025-49113