Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV

CVE-2025-49113

  1. First PoC
  2. 364 days →Metasploit
  3. 137 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2026-02-20 · due 2026-03-13. An observation, not a forecast.
EPSS · 30-day forecast
99%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD
not stated by sourcesNo NVD record yet.
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

26 known · links only

GitHub PoCs · by trust, then stars23

  1. fearsoff-org/CVE-2025-49113 ↗Trust ok 100

    ★ 108 · created 2025-06-04

  2. hakaioffsec/CVE-2025-49113-exploit ↗Trust ok 100

    Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113).

    ★ 93 · created 2025-06-06

  3. 00xCanelo/CVE-2025-49113 ↗Trust ok 100

    💥 Python Exploit for CVE-2025-49113 | Roundcube Webmail RCE via PHP Object Injection

    ★ 8 · created 2025-07-19

  4. BiiTts/Roundcube-CVE-2025-49113 ↗Trust ok 100

    Proof-of-concept to CVE-2025-49113

    ★ 6 · created 2025-06-10

  5. rxerium/CVE-2025-49113 ↗Trust ok 100

    Detection for CVE-2025-49113

    ★ 5 · created 2025-06-03

  6. Zwique/CVE-2025-49113 ↗Trust ok 100

    POC of CVE-2025-49113

    ★ 5 · created 2025-08-24

  7. Ademking/CVE-2025-49113-nuclei-template ↗Trust ok 100

    CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserialization

    ★ 3 · created 2025-06-04

  8. rasool13x/exploit-CVE-2025-49113 ↗Trust ok 100

    ★ 3 · created 2025-06-05

  9. SyFi/CVE-2025-49113 ↗Trust ok 100

    CVE-2025-49113 exploit

    ★ 2 · created 2025-06-06

  10. Joelp03/CVE-2025-49113 ↗Trust ok 100

    ★ 1 · created 2025-07-18

  11. l4f2s4/CVE-2025-49113_exploit_cookies ↗Trust ok 100

    CVE-2025-49113 - Roundcube Remote Code Execution

    ★ 1 · created 2025-09-19

  12. SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP ↗Trust ok 100

    This is a rewritten exploit to work with php

    ★ 1 · created 2025-08-19

  13. 5kr1pt/Roundcube_CVE-2025-49113 ↗Trust ok 100

    Explicação + Lab no THM

    ★ 0 · created 2025-06-17

  14. AC8999/CVE-2025-49113 ↗Trust ok 100

    Python Script for CVE-2025-49113. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    ★ 0 · created 2025-08-29

  15. ankitpandey383/roundcube-cve-2025-49113-lab ↗Trust ok 100

    Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt.

    ★ 0 · created 2025-11-17

  16. CyberQuestor-infosec/CVE-2025-49113-Roundcube_1.6.10 ↗Trust ok 100

    ★ 0 · created 2025-08-18

  17. Evillm/CVE-2025-49113-PoC ↗Trust ok 100

    ★ 0 · created 2026-02-04

  18. hackmelocal/CVE-2025-49113-Simulation ↗Trust ok 100

    ★ 0 · created 2025-07-11

  19. LeakForge/CVE-2025-49113 ↗Trust ok 100

    Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization

    ★ 0 · created 2025-08-30

  20. mooder1/CVE-2025-49113 ↗Trust ok 100

    Roundcube Webmail post-auth RCE via PHP object deserialization (CVE-2025-49113)

    ★ 0 · created 2026-04-11

  21. rank03031/CVE-2025-49113-CTF ↗Trust ok 100

    ★ 0 · created 2026-10-17

  22. rippsec/CVE-2025-49113-Roundcube-RCE ↗Trust ok 100

    CVE-2025-49113 – Roundcube ≤1.6.10 post-auth RCE via PHP object deserialization (HackTheBox CTF)

    ★ 0 · created 2026-04-16

  23. Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113- ↗Trust ok 100

    ★ 0 · created 2025-09-10

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. Roundcube Post-Auth RCE via PHP Object Deserialization ↗

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. An attacker can execute arbitrary system commands as the web server.

    ruby · seen 2026-10-18

Exploit-DB1

  1. Roundcube 1.6.10 - Remote Code Execution (RCE) ↗

    created 2025-06-13

Nuclei1

  1. Roundcube Webmail - Remote Code Execution ↗

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.