CVE-2025-49113·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 97% — in the top 0.1% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade PHP and Roundcube Webmail immediately to version 1.6.11 or later to patch the unsafe deserialization vulnerability in the settings upload handler. This critical flaw allows authenticated attackers to execute arbitrary code by manipulating the _from parameter, bypassing input validation. Apply security updates across all affected servers without delay, as active exploitation has been confirmed.

sudo dnf update php php-common php-cli php-fpm -y

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /roundcube/program/actions/settings/upload.php HTTP/1.1.*_from=.*O:[0-9]+:"[a-zA-Z_][a-zA-Z0-9_]*":[0-9]+:{

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or sanitize POST requests to */settings/upload.php that contain URL-encoded serialized PHP objects in the _from parameter (pattern: O:[0-9]+:). Implement strict input validation to reject any _from parameter values that are not valid email addresses.

How to check if you are affected

1. Check installed PHP version: php -v | grep -oP 'PHP \K[0-9.]+'
2. Verify Roundcube version: grep -i 'RCMAIL_VERSION\|rcmail_version' /path/to/roundcube/program/include/iniset.php
3. Search web server logs for POST requests to settings/upload.php with suspicious _from parameters: grep -i 'settings/upload.php' /var/log/apache2/access.log /var/log/nginx/access.log | grep '_from='
4. Confirm patch applied: php -r "echo phpversion();" and verify against 1.6.11+ release notes

Indicators of compromise

• POST requests to settings/upload.php with _from parameter containing 'O:' (PHP object serialization marker)
• Roundcube process spawning unexpected child processes or shell commands
• Unusual file creation or modification in Roundcube temporary directories (/tmp/roundcube*, /var/tmp)

FAQ

Related PHP CVEs

References

• https://fearsoff.org/research/roundcube
• https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
• https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695
• https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e
• https://github.com/roundcube/roundcubemail/pull/9865