This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Roundcube Webmail fixes 1 critical vulnerability
Roundcube fixes 1 critical vulnerability in Roundcube Webmail in versions 1.6.11 and 1.5.10 [1]. Debian and Ubuntu have not yet released a fix for their stable releases; Red Hat products are not affected by the vulnerability [2][3]. Gentoo has the fixed version 1.6.11 available as testing [4]. A manual fix can be made by creating and applying a patch from the fixed files available at [5]. The changes can be verified in the commit available at [6].
An authenticated remote attacker can execute arbitrary PHP code on the server by sending a specially crafted file upload request [7].
The vulnerability is present in product:
- Roundcube; >1.5.10; >=1.6, <1.6.11;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-49113 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 2. 6. 2025.
Links
- [1] https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
- [2] https://security-tracker.debian.org/tracker/CVE-2025-49113
- [3] https://access.redhat.com/security/cve/cve-2025-49113
- [4] https://packages.gentoo.org/packages/mail-client/roundcube
- [5] https://github.com/roundcube/roundcubemail/releases/tag/1.6.11
- [6] https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
- [7] https://nvd.nist.gov/vuln/detail/CVE-2025-49113
By CESNET, z.s.p.o. Martin Krajči on 2. 6. 2025.