Description
Roundcube Webmail 1.5.10之前版本和 1.6.11之前版本存在安全漏洞，该漏洞源于未验证_from参数，可能导致PHP对象反序列化攻击。
Roundcube Webmail代码执行漏洞(CVE-2025-49113)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-49113
https://www.cve.org/CVERecord?id=CVE-2025-49113
https://fearsoff.org/research/roundcube
https://thehackernews.com/2025/06/critical-10-year-old-roundcube-webmail.html
https://github.com/hakaioffsec/CVE-2025-49113-exploit
https://www.offsec.com/blog/cve-2025-49113/
https://www.exploit-db.com/exploits/52324
https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
https://talk.plesk.com/threads/roundcube-vulnerability-cve-2025-49113.378155/