Roundcube Webmail PHP Object Deserialization Remote Code Execution Vulnerability Advisory (CVE-2025-49113)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-49113) is a critical PHP Object Deserialization flaw (CWE-502) residing in Roundcube Webmail's settings upload functionality. The root cause lies in the lack of input validation and sanitization of the _from parameter within the program/actions/settings/upload.php script. When an attacker supplies a serialized PHP object via this parameter, the application processes it using the PHP unserialize() function, allowing the instantiation of arbitrary PHP objects and triggering magic methods.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first authenticate to the Roundcube Webmail interface with low-privilege user credentials (PR:L). Once authenticated, the attacker sends a crafted HTTP request targeting upload.php with a malicious serialized PHP payload injected into the _from URL parameter. During deserialization, the PHP engine executes destructor or wakeup magic methods associated with existing classes in the application scope (POP chain), ultimately leading to arbitrary OS command execution under the context of the web server user.

3. Infrastructure & Business Impact

With a CVSS score of 9.9 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to enterprise mail infrastructures. The EPSS score of 0.9949 indicates a near-certain probability of exploitation attempts. Successful exploitation allows full compromise of the mail server, enabling attackers to exfiltrate sensitive communications, hijack user accounts, and pivot into the internal corporate network.