CVE-2025-49113

RoundCube Webmail is the web-based system many businesses use to read and send emails. This flaw can let someone who is already logged in use a specially crafted link to trick the server into running attacker code.

Think of it like a “logged-in guest” leaving a hidden switch on your building’s electrical panel—if they can reach it, they can potentially cause serious damage.

This matters if your business runs RoundCube Webmail (webmail) and it’s installed in a vulnerable version prior to the fixed releases. Because the attacker must be authenticated, the risk is mainly about stolen or valid webmail logins being used against you.

It’s a risk when the vulnerable RoundCube Webmail version is reachable by a user who can successfully log in (for example, via your normal webmail sign-in page).

This is RED because confirmed guidance from CISA places CVE-2025-49113 in its KEV catalog, meaning it is expected to be actively relevant. Attackers only need an authenticated session, so any exposed or compromised webmail credentials become a direct path to full server compromise.

You should treat the due date in CISA KEV (2026-03-13) as the timeline to complete remediation.

Confirm whether you’re affected

1. Identify the exact RoundCube Webmail version running on your server (from your RoundCube installation/about page, server package info, or the application files).
2. Determine whether it matches an affected range:
   • 1.5 branch: versions before 1.5.10
   • 1.6 branch: versions before 1.6.11

Upgrade to the fixed version

• Upgrade to 1.5.10 for the 1.5 line.
• Upgrade to 1.6.11 for the 1.6 line.

If patching is delayed

• Apply the available mitigations/workarounds referenced for CVE-2025-49113 and follow any vendor guidance for temporary risk reduction.
• Reduce the chance of authenticated misuse by tightening access controls to webmail (for example, limiting exposure, enforcing strong authentication, and ensuring only authorized users have access).

Evidence checks (after changes and/or during response)

• Check web server logs and RoundCube logs for suspicious requests involving the “_from” URL parameter handling, especially around the time you notice suspicious user activity.
• Look for signs of unexpected server-side actions following authenticated webmail access.

Tracking and deadlines

• This vulnerability is listed in CISA KEV with a remediation due date of 2026-03-13. Prioritize completing the upgrade before that date, or immediately start mitigations if you cannot upgrade on time.

CVE-2025-49113 is a high-impact server-side issue in RoundCube Webmail (CWE-502) where attacker-controlled input in the URL “_from” parameter is not properly validated, allowing authenticated users to trigger arbitrary code execution on the webmail server. The KEV entry indicates it has been considered real enough to require action under CISA guidance.

Findings indicate:

• Authentication required: Yes (attacker must be logged in).
• User interaction: No (the attacker can trigger via crafted requests).
• Exploitation status: Confirmed real-world relevance via CISA KEV listing.
• Fixed versions: RoundCube/roundcubemail 1.5.10 and 1.6.11 (per the patch cards).

Exploit maturity is reflected by KEV inclusion (and CISA due date), which makes it a priority over purely predicted likelihood.