CVE-2025-49113: listed in the CISA KEV catalog

CVE-2025-49113 · CVSS 9.9 CRITICAL · EPSS 99% · KEV 2026-02-20 · patch available

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Is CVE-2025-49113 exploited?

• Listed in the CISA KEV catalog on 2026-02-20.
• Federal remediation due 2026-03-13.
• Past that date by 231 days.
• EPSS puts exploitation in the next 30 days at 99%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

• Roundcube · Webmail · >= 0, < 1.5.10, >= 1.6.0, < 1.6.11
• debian · debian linux · 11.0

Is there a patch?

Yes. Update to one of these or later:

From Roundcube's CVE record · Roundcube advisory

What PlainSec published about CVE-2025-49113

• Roundcube makes university mail a foothold (2026-07-11)

Primary sources

• NVD record
• CISA KEV catalog
• Roundcube advisory
• Metasploit: exploit/multi/http/roundcube_auth_rce_cve_2025_49113
• Exploit-DB 52324
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-10-29.