CVE-2025-49113
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.9epss 98%
da publicação à arma0 dias
Publicada no NVD2 de jun.
1ª PoC12 de abr.
metasploit2 de jun.
CISA KEV+263d
probabilidade de exploração
98%top 1% das CVEs
exploração observada
simCISA + VulnCheck
41 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2026-03-13
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Versões
Afetadas
composer/roundcube/roundcubemail < 1.5.10; composer/roundcube/roundcubemail >= 1.6.0, < 1.6.11
Corrigidas em
composer/roundcube/roundcubemail 1.5.10; composer/roundcube/roundcubemail 1.6.11
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Roundcube · WebmailPoCs públicas encontradas — 41
exploitdbwww.exploit-db.com/exploits/52324não verificadogithubgithub.com/fearsoff-org/CVE-2025-49113★ 108githubgithub.com/hakaioffsec/CVE-2025-49113-exploit★ 92githubgithub.com/00xCanelo/CVE-2025-49113★ 8githubgithub.com/BiiTts/Roundcube-CVE-2025-49113★ 6githubgithub.com/rxerium/CVE-2025-49113★ 5githubgithub.com/Zwique/CVE-2025-49113★ 5githubgithub.com/Ademking/CVE-2025-49113-nuclei-template★ 3githubgithub.com/rasool13x/exploit-CVE-2025-49113★ 3githubgithub.com/SyFi/CVE-2025-49113★ 2githubgithub.com/Joelp03/CVE-2025-49113★ 1githubgithub.com/l4f2s4/CVE-2025-49113_exploit_cookies★ 1githubgithub.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP★ 1githubgithub.com/AC8999/CVE-2025-49113★ 0githubgithub.com/5kr1pt/Roundcube_CVE-2025-49113★ 0githubgithub.com/punitdarji/roundcube-cve-2025-49113★ 0githubgithub.com/hackmelocal/CVE-2025-49113-Simulation★ 0githubgithub.com/CyberQuestor-infosec/CVE-2025-49113-Roundcube_1.6.10★ 0githubgithub.com/LeakForge/CVE-2025-49113★ 0githubgithub.com/Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-★ 0githubgithub.com/ankitpandey383/roundcube-cve-2025-49113-lab★ 0githubgithub.com/Evillm/CVE-2025-49113-PoC★ 0githubgithub.com/mooder1/CVE-2025-49113★ 0githubgithub.com/rippsec/CVE-2025-49113-Roundcube-RCE★ 0vulncheckvulncheck.com/xdb/c677c69937f8não verificadovulncheckvulncheck.com/xdb/b58adaecc268não verificadovulncheckvulncheck.com/xdb/7695cc6dfe09não verificadovulncheckvulncheck.com/xdb/e7fe4d3a4995não verificadovulncheckvulncheck.com/xdb/723747ceedbbnão verificadovulncheckvulncheck.com/xdb/33f506cba416não verificadovulncheckvulncheck.com/xdb/75c30f2fa63dnão verificadovulncheckvulncheck.com/xdb/e772d119ea95não verificadovulncheckvulncheck.com/xdb/aebffdccd3denão verificadovulncheckvulncheck.com/xdb/59604bbbb3fanão verificadovulncheckvulncheck.com/xdb/b037dfabf975não verificadovulncheckvulncheck.com/xdb/f2cc9a510d73não verificadovulncheckvulncheck.com/xdb/97288c041629não verificadovulncheckvulncheck.com/xdb/907e255a46cbnão verificadovulncheckvulncheck.com/xdb/97b1284b1784não verificadovulncheckvulncheck.com/xdb/d329bc052233não verificadovulncheckvulncheck.com/xdb/b56aba012470não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://fearsoff.org/research/roundcubehttps://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4dhttps://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637ehttps://github.com/roundcube/roundcubemail/pull/9865https://github.com/roundcube/roundcubemail/releases/tag/1.5.10https://github.com/roundcube/roundcubemail/releases/tag/1.6.11https://lists.debian.org/debian-lts-announce/2025/06/msg00008.htmlhttps://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-scripthttps://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection