[Update] Vulnerability in Roundcube (June 5, 2025)

unknownpublic exploitCVE-2025-49113

[Update on June 6, 2025] A proof of concept is publicly available. [Initial release] On June 1, 2025, Roundcube released patches for a critical vulnerability affecting its email portal as well as all products including it (for example, cPanel and...

CSIRTS triage

vendor: Roundcube product: Roundcube Remote code execution

What: A critical vulnerability affecting the email portal has been identified.
Who is affected: All products including Roundcube that utilize the email portal.
Urgency: Remediation is urgent due to the availability of a proof of concept for exploitation.
Action: Apply the patches released on June 1, 2025.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Roundcube

Get an email when a new Roundcube advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2025-06-05
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2025-ALE-008/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2025-49113EPSS puts this in the most-targeted tier (89.5% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-49113	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalexploitedAL25-007 - Vulnerability impacting Roundcube Webmail – CVE-2025-49113 – Update 1cccs
criticalexploitedCVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerabilitycisa-kev

Recent advisories for Roundcube

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalexploitedAL25-007 - Vulnerability impacting Roundcube Webmail – CVE-2025-49113 – Update 1cccs · 2026-07-10
medium[NEW] [medium] Roundcube: Multiple vulnerabilitiescert-bund · 2026-07-07
unknownRoundcube security advisory (AV26-657)cccs · 2026-07-06
unknownMultiple vulnerabilities in Roundcube (July 6, 2026)cert-fr-avis · 2026-07-06
criticalexploitedCVE-2025-68461: RoundCube Webmail Cross-site Scripting Vulnerabilitycisa-kev · 2026-02-20
criticalexploitedCVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerabilitycisa-kev · 2026-02-20